CVE-2012-6562
medium
CVSS v3
—
CVSS v2
6.8
VIR risk
6.8
Description
engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accounts.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cve@mitre.org — http://secunia.com/advisories/49129
Vendor advisory: cve@mitre.org — http://elgg.org/getelgg.php?forward=elgg-1.8.5.zip
Vendor advisory: cve@mitre.org — http://blog.elgg.org/pg/blog/evan/read/209/elgg-185-released
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| elgg | elgg | {"endIncluding":"1.8.4"} | |
| elgg | elgg | 1.7.0 | |
| elgg | elgg | 1.7.1 | |
| elgg | elgg | 1.7.2 | |
| elgg | elgg | 1.7.3 | |
| elgg | elgg | 1.7.4 | |
| elgg | elgg | 1.7.5 | |
| elgg | elgg | 1.7.6 | |
| elgg | elgg | 1.7.7 | |
| elgg | elgg | 1.7.8 | |
| elgg | elgg | 1.7.9 | |
| elgg | elgg | 1.7.10 | |
| elgg | elgg | 1.7.11 | |
| elgg | elgg | 1.7.12 | |
| elgg | elgg | 1.7.13 | |
| elgg | elgg | 1.7.14 | |
| elgg | elgg | 1.7.15 | |
| elgg | elgg | 1.7.16 | |
| elgg | elgg | 1.7.17 | |
| elgg | elgg | 1.7.18 | |
| elgg | elgg | 1.8.0.1 | |
| elgg | elgg | 1.8.1 | |
| elgg | elgg | 1.8.3 | |
References
- http://blog.elgg.org/pg/blog/evan/read/209/elgg-185-released
- http://elgg.org/getelgg.php?forward=elgg-1.8.5.zip
- http://secunia.com/advisories/49129
- http://www.securityfocus.com/bid/53623
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75757
- http://blog.elgg.org/pg/blog/evan/read/209/elgg-185-released
- http://elgg.org/getelgg.php?forward=elgg-1.8.5.zip
- http://secunia.com/advisories/49129
- http://www.securityfocus.com/bid/53623
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75757
CWEs
CWE-264
Verify integrity in audit chain (admin only). AS-IS.