NVD Vulnerability Detail

CVE-2012-6562

Summary	engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accounts.
Publication Date	May 24, 2013, 12:55 a.m.
Registration Date	Jan. 28, 2021, 3:08 p.m.
Last Update	Nov. 21, 2024, 10:46 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://blog.elgg.org/pg/blog/evan/read/209/elgg-185-released	Vendor Advisory
2	http://blog.elgg.org/pg/blog/evan/read/209/elgg-185-released	Vendor Advisory
3	http://elgg.org/getelgg.php?forward=elgg-1.8.5.zip	Patch Vendor Advisory
4	http://elgg.org/getelgg.php?forward=elgg-1.8.5.zip	Patch Vendor Advisory
5	http://secunia.com/advisories/49129	Vendor Advisory
6	http://secunia.com/advisories/49129	Vendor Advisory
7	http://www.securityfocus.com/bid/53623
8	http://www.securityfocus.com/bid/53623
9	https://exchange.xforce.ibmcloud.com/vulnerabilities/75757
10	https://exchange.xforce.ibmcloud.com/vulnerabilities/75757

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

JVN Vulnerability Information

Elgg の engine/lib/users.php における任意のアカウントを作成される脆弱性

Title	Elgg の engine/lib/users.php における任意のアカウントを作成される脆弱性
Summary	Elgg の engine/lib/users.php には、useradd アクション用の権限を適切に指定しないため、任意のアカウントを作成される脆弱性が存在します。
Possible impacts	第三者により、任意のアカウントを作成される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 19, 2012, midnight
Registration Date	May 27, 2013, 3:57 p.m.
Last Update	May 27, 2013, 3:57 p.m.

Affected System

Elgg

Elgg 1.8.5 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-6562	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6562
National Vulnerability Database (NVD)
2	CVE-2012-6562	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6562

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
elgg
1	Elgg 1.8.5 Released	http://blog.elgg.org/pg/blog/evan/read/209/elgg-185-released
2	elgg-1.8.5.zip	http://elgg.org/getelgg.php?forward=elgg-1.8.5.zip

Change Log

No	Changed Details	Date of change
0	[2013年05月27日] 掲載	Feb. 17, 2018, 10:37 a.m.