Lucene search

[email protected]CVE-2012-5004

HistorySep 19, 2012 - 9:55 p.m.

CVE-2012-5004

2012-09-1921:55:07

CWE-352

[email protected]

web.nvd.nist.gov

cve-2012-5004

csrf

parallels h-sphere

vulnerability

admin hijacking

remote attack

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.4 High

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

77.7%

JSON

Multiple cross-site request forgery (CSRF) vulnerabilities in Parallels H-Sphere 3.3 Patch 1 allow remote attackers to hijack the authentication of admins for requests that (1) add group plans via admin/group_plans.html or (2) add extra packages via admin/extra_packs/create_extra_pack.html.

Affected configurations

NVD

Node

parallelsh-sphereMatch3.3p1

CPENameOperatorVersion
parallels:h-sphereparallels h-sphereeq3.3

CPE	Name	Operator	Version
parallels:h-sphere	parallels h-sphere	eq	3.3

References

osvdb.org/78505

packetstormsecurity.org/files/view/108972/VL-392.txt

secunia.com/advisories/47556

www.vulnerability-lab.com/get_content.php?id=392

exchange.xforce.ibmcloud.com/vulnerabilities/72628

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.4 High

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

77.7%

JSON

Related for CVE-2012-5004

nvd1 prion1 cvelist1