{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-02-28T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Webfolio CMS 1.1.4 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via an add action to admin/users/add or (2) modify a web page via a save action to admin/pages/edit/web_page_name."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "79658", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/79658"}, {"name": "18536", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "http://www.exploit-db.com/exploits/18536"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.org/files/110294/WebfolioCMS-1.1.4-Cross-Site-Request-Forgery.html"}, {"name": "52218", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/52218"}, {"tags": ["x_refsource_MISC"], "url": "http://ivanobinetti.blogspot.com/2012/02/webfoliocms-114-csrf-add-adminmodify.html"}, {"name": "48190", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/48190"}, {"name": "webfoliocms-addadmin-modifywebpage-csrf(73575)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73575"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2012-1498", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Webfolio CMS 1.1.4 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via an add action to admin/users/add or (2) modify a web page via a save action to admin/pages/edit/web_page_name."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "79658", "refsource": "OSVDB", "url": "http://osvdb.org/79658"}, {"name": "18536", "refsource": "EXPLOIT-DB", "url": "http://www.exploit-db.com/exploits/18536"}, {"name": "http://packetstormsecurity.org/files/110294/WebfolioCMS-1.1.4-Cross-Site-Request-Forgery.html", "refsource": "MISC", "url": "http://packetstormsecurity.org/files/110294/WebfolioCMS-1.1.4-Cross-Site-Request-Forgery.html"}, {"name": "52218", "refsource": "BID", "url": "http://www.securityfocus.com/bid/52218"}, {"name": "http://ivanobinetti.blogspot.com/2012/02/webfoliocms-114-csrf-add-adminmodify.html", "refsource": "MISC", "url": "http://ivanobinetti.blogspot.com/2012/02/webfoliocms-114-csrf-add-adminmodify.html"}, {"name": "48190", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/48190"}, {"name": "webfoliocms-addadmin-modifywebpage-csrf(73575)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73575"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2012-1498", "datePublished": "2012-03-19T19:00:00", "dateReserved": "2012-03-03T00:00:00", "dateUpdated": "2017-08-28T12:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nikola_posa:webfoliocms1.0.2:*:*:*:*:*:*:*:*", "matchCriteriaId": "E9A2BDD5-3EEC-4211-96C0-0CC41C26D897", "vulnerable": true}, {"criteria": "cpe:2.3:a:nikola_posa:webfoliocms1.0.3:*:*:*:*:*:*:*:*", "matchCriteriaId": "4FC9F75D-0141-44DA-9CFF-B4DB0B8254A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:nikola_posa:webfoliocms1.0.4:*:*:*:*:*:*:*:*", "matchCriteriaId": "616A7502-918E-4CCE-A889-2FF81D832E0B", "vulnerable": true}, {"criteria": "cpe:2.3:a:nikola_posa:webfoliocms1.0.5:*:*:*:*:*:*:*:*", "matchCriteriaId": "011300FC-3C6E-46EE-9F04-ECBF3771625C", "vulnerable": true}, {"criteria": "cpe:2.3:a:nikola_posa:webfoliocms1.0.6:*:*:*:*:*:*:*:*", "matchCriteriaId": "F1FA1C0A-1271-48FF-98B2-14B1186E0DEB", "vulnerable": true}, {"criteria": "cpe:2.3:a:nikola_posa:webfoliocms1.0.7:*:*:*:*:*:*:*:*", "matchCriteriaId": "82DE22C4-0788-46DD-96EA-3E6E6511CCCB", "vulnerable": true}, {"criteria": "cpe:2.3:a:nikola_posa:webfoliocms1.0.8:*:*:*:*:*:*:*:*", "matchCriteriaId": "449CE159-5743-4ED2-8CEF-8AAE60524402", "vulnerable": true}, {"criteria": "cpe:2.3:a:nikola_posa:webfoliocms1.0.9:*:*:*:*:*:*:*:*", "matchCriteriaId": "6505F0D3-CD0D-4F77-9DE8-0694D627613A", "vulnerable": true}, {"criteria": "cpe:2.3:a:nikola_posa:webfoliocms1.1.0:*:*:*:*:*:*:*:*", "matchCriteriaId": "1AD2DB12-1738-464B-BB3E-191A36F0F96F", "vulnerable": true}, {"criteria": "cpe:2.3:a:nikola_posa:webfoliocms1.1.1:*:*:*:*:*:*:*:*", "matchCriteriaId": "01696D3C-C044-487B-86AB-10BFB195097F", "vulnerable": true}, {"criteria": "cpe:2.3:a:nikola_posa:webfoliocms1.1.2:*:*:*:*:*:*:*:*", "matchCriteriaId": "7FF2FA4B-1264-4BB6-BD22-8E9B7159CA90", "vulnerable": true}, {"criteria": "cpe:2.3:a:nikola_posa:webfoliocms1.1.3:*:*:*:*:*:*:*:*", "matchCriteriaId": "BFF34987-9712-4BC7-9E4F-749A961DD5EA", "vulnerable": true}, {"criteria": "cpe:2.3:a:nikola_posa:webfoliocms1.1.4:*:*:*:*:*:*:*:*", "matchCriteriaId": "D2F5B098-BB27-4953-B7E6-404C0318583C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Webfolio CMS 1.1.4 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via an add action to admin/users/add or (2) modify a web page via a save action to admin/pages/edit/web_page_name."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en Webfolio CMS 1.1.4 y anteriores permiten a atacantes remotos secuestrar la autenticaci\u00f3n de administradores para peticiones que (1) a\u00f1aden un admistrador a trav\u00e9s de una acci\u00f3n \"add\" de admin/users/add o (2) modifican una p\u00e1gina web a trav\u00e9s de una acci\u00f3n \"save\" de admin/pages/edit/web_page_name."}], "id": "CVE-2012-1498", "lastModified": "2017-08-29T01:31:17.757", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2012-03-19T19:55:04.360", "references": [{"source": "cve@mitre.org", "url": "http://ivanobinetti.blogspot.com/2012/02/webfoliocms-114-csrf-add-adminmodify.html"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/79658"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://packetstormsecurity.org/files/110294/WebfolioCMS-1.1.4-Cross-Site-Request-Forgery.html"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/48190"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.exploit-db.com/exploits/18536"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/52218"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73575"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}