Lucene search

PRIOn knowledge basePRION:CVE-2012-3472

HistoryAug 12, 2012 - 9:55 p.m.

Authentication flaw

2012-08-1221:55:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

0.002 Low

EPSS

Percentile

61.2%

JSON

The email API in application/libraries/api/MY_Email_Api_Object.php in the Ushahidi Platform before 2.5 does not require authentication, which allows remote attackers to list, delete, or organize messages via a GET request.

CPENameOperatorVersion
ushahidi_platformeq2.1
ushahidi_platformeq2.0
ushahidi_platformeq1.0
ushahidi_platformeq2.2.1
ushahidi_platformle2.4.1
ushahidi_platformeq2.3.1
ushahidi_platformeq2.2
ushahidi_platformeq2.4
ushahidi_platformeq2.3.2
ushahidi_platformeq1.2

Name	Operator	Version
ushahidi_platform	eq	2.1
ushahidi_platform	eq	2.0
ushahidi_platform	eq	1.0
ushahidi_platform	eq	2.2.1
ushahidi_platform	le	2.4.1
ushahidi_platform	eq	2.3.1
ushahidi_platform	eq	2.2
ushahidi_platform	eq	2.4
ushahidi_platform	eq	2.3.2
ushahidi_platform	eq	1.2

References

openwall.com/lists/oss-security/2012/08/09/5

github.com/ushahidi/Ushahidi_Web/commit/4c24325

7.2 High

AI Score

Confidence

Low

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

0.002 Low

EPSS

Percentile

61.2%

JSON

Related for PRION:CVE-2012-3472