{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-06-21T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijack the authentication of users for requests that add, delete, or modify sensitive information, as demonstrated by changing the administrator's email via an editUser action to lib/usermanagement/userInfo.php."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "21135", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "http://www.exploit-db.com/exploits/21135"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.org/files/116275/TestLink-1.9.3-Cross-Site-Request-Forgery.html"}, {"name": "testlink-userinfo-csrf(78306)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78306"}, {"name": "20120905 Cross-Site Request Forgery (CSRF) in TestLink", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://archives.neohapsis.com/archives/bugtraq/2012-09/0023.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://gitorious.org/testlink-ga/testlink-code/commit/252788c2373e73173172ada9af661e0721599891"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://gitorious.org/testlink-ga/testlink-code/commit/c8751a3c9ad8970b49d1bf882203efacd10af087"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://gitorious.org/testlink-ga/testlink-code/commit/2d4ac941314f8bda80e265c9de8bacf17d1cd3e6"}, {"tags": ["x_refsource_MISC"], "url": "https://www.htbridge.com/advisory/HTB23088"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2012-2275", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijack the authentication of users for requests that add, delete, or modify sensitive information, as demonstrated by changing the administrator's email via an editUser action to lib/usermanagement/userInfo.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "21135", "refsource": "EXPLOIT-DB", "url": "http://www.exploit-db.com/exploits/21135"}, {"name": "http://packetstormsecurity.org/files/116275/TestLink-1.9.3-Cross-Site-Request-Forgery.html", "refsource": "MISC", "url": "http://packetstormsecurity.org/files/116275/TestLink-1.9.3-Cross-Site-Request-Forgery.html"}, {"name": "testlink-userinfo-csrf(78306)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78306"}, {"name": "20120905 Cross-Site Request Forgery (CSRF) in TestLink", "refsource": "BUGTRAQ", "url": "http://archives.neohapsis.com/archives/bugtraq/2012-09/0023.html"}, {"name": "http://gitorious.org/testlink-ga/testlink-code/commit/252788c2373e73173172ada9af661e0721599891", "refsource": "CONFIRM", "url": "http://gitorious.org/testlink-ga/testlink-code/commit/252788c2373e73173172ada9af661e0721599891"}, {"name": "http://gitorious.org/testlink-ga/testlink-code/commit/c8751a3c9ad8970b49d1bf882203efacd10af087", "refsource": "CONFIRM", "url": "http://gitorious.org/testlink-ga/testlink-code/commit/c8751a3c9ad8970b49d1bf882203efacd10af087"}, {"name": "http://gitorious.org/testlink-ga/testlink-code/commit/2d4ac941314f8bda80e265c9de8bacf17d1cd3e6", "refsource": "CONFIRM", "url": "http://gitorious.org/testlink-ga/testlink-code/commit/2d4ac941314f8bda80e265c9de8bacf17d1cd3e6"}, {"name": "https://www.htbridge.com/advisory/HTB23088", "refsource": "MISC", "url": "https://www.htbridge.com/advisory/HTB23088"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2012-2275", "datePublished": "2012-09-15T17:00:00", "dateReserved": "2012-04-18T00:00:00", "dateUpdated": "2017-08-28T12:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:teamst:testlink:*:*:*:*:*:*:*:*", "matchCriteriaId": "D2C93C8A-BD77-4B1E-895B-DF268390F3C8", "versionEndIncluding": "1.9.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:teamst:testlink:1.7:*:*:*:*:*:*:*", "matchCriteriaId": "59E20AB1-CE62-4F45-AF92-C31DB56846E7", "vulnerable": true}, {"criteria": "cpe:2.3:a:teamst:testlink:1.7.0:*:*:*:*:*:*:*", "matchCriteriaId": "DFC3D840-86DA-45A8-AAB6-204343B6EE8E", "vulnerable": true}, {"criteria": "cpe:2.3:a:teamst:testlink:1.7.1:*:*:*:*:*:*:*", "matchCriteriaId": "4E88B7B2-FA29-41EF-A2FB-4B5EF3889435", "vulnerable": true}, {"criteria": "cpe:2.3:a:teamst:testlink:1.7.2:*:*:*:*:*:*:*", "matchCriteriaId": "1B667E47-CFD5-4125-844D-F79505FC95C4", "vulnerable": true}, {"criteria": "cpe:2.3:a:teamst:testlink:1.7.3:*:*:*:*:*:*:*", "matchCriteriaId": "EFFAFFD7-26B8-4ADF-B134-F71268EC9FCD", "vulnerable": true}, {"criteria": "cpe:2.3:a:teamst:testlink:1.7.4:*:*:*:*:*:*:*", "matchCriteriaId": "E136AD4F-552C-4414-A8B4-0CEC91480671", "vulnerable": true}, {"criteria": "cpe:2.3:a:teamst:testlink:1.8:*:*:*:*:*:*:*", "matchCriteriaId": "5EE00F0B-F58E-4AB8-B66E-A2BD4CF03EA2", "vulnerable": true}, {"criteria": "cpe:2.3:a:teamst:testlink:1.8:beta1:*:*:*:*:*:*", "matchCriteriaId": "4434FB82-6BA6-4335-8FF0-26738318FB41", "vulnerable": true}, {"criteria": "cpe:2.3:a:teamst:testlink:1.8:beta2:*:*:*:*:*:*", "matchCriteriaId": "F5FEACF5-86A6-4E8C-896E-436E2FF2948F", "vulnerable": true}, {"criteria": "cpe:2.3:a:teamst:testlink:1.8:beta3:*:*:*:*:*:*", "matchCriteriaId": "956B741E-6FCC-46B2-8164-3322F6418CAA", "vulnerable": true}, {"criteria": "cpe:2.3:a:teamst:testlink:1.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "F38156CE-2A5E-4308-BE28-DCE78F9C2147", "vulnerable": true}, {"criteria": "cpe:2.3:a:teamst:testlink:1.8.0:*:*:*:*:*:*:*", "matchCriteriaId": "A5158177-EFF7-47B1-A159-59283B814209", "vulnerable": true}, {"criteria": "cpe:2.3:a:teamst:testlink:1.8.1:*:*:*:*:*:*:*", "matchCriteriaId": "116616D2-2F87-41A3-880E-7C1C1BC460FB", "vulnerable": true}, {"criteria": "cpe:2.3:a:teamst:testlink:1.8.2:*:*:*:*:*:*:*", "matchCriteriaId": "70877F5A-C793-4D3F-8078-185C8DD20B73", "vulnerable": true}, {"criteria": "cpe:2.3:a:teamst:testlink:1.8.3:*:*:*:*:*:*:*", "matchCriteriaId": "7AC91095-A80B-4193-9414-A94DD3D1800B", "vulnerable": true}, {"criteria": "cpe:2.3:a:teamst:testlink:1.8.4:*:*:*:*:*:*:*", "matchCriteriaId": "6AE56DCB-B3CB-4FA8-8670-5139F858BD82", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijack the authentication of users for requests that add, delete, or modify sensitive information, as demonstrated by changing the administrator's email via an editUser action to lib/usermanagement/userInfo.php."}, {"lang": "es", "value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en TestLink v1.9.3 y anteriores permite a atacantes remotos secuestrar la autenticaci\u00f3n de los usuarios para peticiones que a\u00f1adan, borren o modifiquen informaci\u00f3n sensible, como se demostr\u00f3 cambiando el correo del administrador a trav\u00e9s de una acci\u00f3n editUser sobre lib/usermanagement/userInfo.php."}], "id": "CVE-2012-2275", "lastModified": "2017-08-29T01:31:34.477", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2012-09-15T17:55:05.863", "references": [{"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://archives.neohapsis.com/archives/bugtraq/2012-09/0023.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Patch"], "url": "http://gitorious.org/testlink-ga/testlink-code/commit/252788c2373e73173172ada9af661e0721599891"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Patch"], "url": "http://gitorious.org/testlink-ga/testlink-code/commit/2d4ac941314f8bda80e265c9de8bacf17d1cd3e6"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Patch"], "url": "http://gitorious.org/testlink-ga/testlink-code/commit/c8751a3c9ad8970b49d1bf882203efacd10af087"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://packetstormsecurity.org/files/116275/TestLink-1.9.3-Cross-Site-Request-Forgery.html"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.exploit-db.com/exploits/21135"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78306"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "https://www.htbridge.com/advisory/HTB23088"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}