CVE-2012-0286
medium
CVSS v3
—
CVSS v2
6.8
VIR risk
6.8
Description
Cross-site request forgery (CSRF) vulnerability in Stoneware webNetwork before 6.0.8.0 allows remote attackers to hijack the authentication of unspecified victims for requests that modify user accounts.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cve@mitre.org — http://www.stone-ware.com/swql.jsp?kb=d1960
Vendor advisory: cve@mitre.org — http://www.stone-ware.com/support/techdocs/kb/d1960/sb_6_0_8.pdf
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| stone-ware | webnetwork | {"endIncluding":"6.0.7.0"} | |
| stone-ware | webnetwork | 6.0.5.0 | |
References
- http://infosec42.blogspot.com/2012/01/cve-2012-0285-and-cve-2012-0286.html
- http://www.stone-ware.com/support/techdocs/kb/d1960/sb_6_0_8.pdf
- http://www.stone-ware.com/swql.jsp?kb=d1960
- http://infosec42.blogspot.com/2012/01/cve-2012-0285-and-cve-2012-0286.html
- http://www.stone-ware.com/support/techdocs/kb/d1960/sb_6_0_8.pdf
- http://www.stone-ware.com/swql.jsp?kb=d1960
CWEs
CWE-352
Verify integrity in audit chain (admin only). AS-IS.