NVD Vulnerability Detail

CVE-2012-2275

Summary	Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijack the authentication of users for requests that add, delete, or modify sensitive information, as demonstrated by changing the administrator's email via an editUser action to lib/usermanagement/userInfo.php.
Publication Date	Sept. 16, 2012, 2:55 a.m.
Registration Date	Jan. 28, 2021, 2:57 p.m.
Last Update	Nov. 21, 2024, 10:38 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://archives.neohapsis.com/archives/bugtraq/2012-09/0023.html	Exploit
2	http://archives.neohapsis.com/archives/bugtraq/2012-09/0023.html	Exploit
3	http://gitorious.org/testlink-ga/testlink-code/commit/252788c2373e73173172ada9af661e0721599891	Exploit Patch
4	http://gitorious.org/testlink-ga/testlink-code/commit/252788c2373e73173172ada9af661e0721599891	Exploit Patch
5	http://gitorious.org/testlink-ga/testlink-code/commit/2d4ac941314f8bda80e265c9de8bacf17d1cd3e6	Exploit Patch
6	http://gitorious.org/testlink-ga/testlink-code/commit/2d4ac941314f8bda80e265c9de8bacf17d1cd3e6	Exploit Patch
7	http://gitorious.org/testlink-ga/testlink-code/commit/c8751a3c9ad8970b49d1bf882203efacd10af087	Exploit Patch
8	http://gitorious.org/testlink-ga/testlink-code/commit/c8751a3c9ad8970b49d1bf882203efacd10af087	Exploit Patch
9	http://packetstormsecurity.org/files/116275/TestLink-1.9.3-Cross-Site-Request-Forgery.html	Exploit
10	http://packetstormsecurity.org/files/116275/TestLink-1.9.3-Cross-Site-Request-Forgery.html	Exploit
11	http://www.exploit-db.com/exploits/21135	Exploit
12	http://www.exploit-db.com/exploits/21135	Exploit
13	https://exchange.xforce.ibmcloud.com/vulnerabilities/78306
14	https://exchange.xforce.ibmcloud.com/vulnerabilities/78306
15	https://www.htbridge.com/advisory/HTB23088	Exploit
16	https://www.htbridge.com/advisory/HTB23088	Exploit

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-352	クロスサイト・リクエスト・フォージェリ（CSRF）	https://cwe.mitre.org/data/definitions/352.html
2	CWE-352	同一生成元ポリシー違反	https://cwe.mitre.org/data/definitions/346.html

JVN Vulnerability Information

TestLink におけるクロスサイトリクエストフォージェリの脆弱性

Title	TestLink におけるクロスサイトリクエストフォージェリの脆弱性
Summary	TestLink には、クロスサイトリクエストフォージェリの脆弱性が存在します。
Possible impacts	第三者により、重要な情報の追加、削除、または編集のリクエストに対するユーザの認証をハイジャックされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 15, 2012, midnight
Registration Date	Sept. 19, 2012, 4:12 p.m.
Last Update	Sept. 19, 2012, 4:12 p.m.

Affected System

TestLink Development Team

TestLink 1.9.3 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-2275	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2275
National Vulnerability Database (NVD)
2	CVE-2012-2275	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2275

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-352	https://jvndb.jvn.jp/ja/cwe/CWE-352.html

ベンダー情報

No	Name	URL
Gitorious
1	Commit 252788c2373e73173172ada9af661e0721599891	https://gitorious.org/testlink-ga/testlink-code/commit/252788c2373e73173172ada9af661e0721599891
2	Commit 2d4ac941314f8bda80e265c9de8bacf17d1cd3e6	http://gitorious.org/testlink-ga/testlink-code/commit/2d4ac941314f8bda80e265c9de8bacf17d1cd3e6
3	Commit c8751a3c9ad8970b49d1bf882203efacd10af087	http://gitorious.org/testlink-ga/testlink-code/commit/c8751a3c9ad8970b49d1bf882203efacd10af087

Change Log

No	Changed Details	Date of change
0	[2012年09月19日] 掲載	Feb. 17, 2018, 10:37 a.m.