CVE-2012-0865: Input Validation
Published Feb 21, 2012
·Updated
Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) r parameter to switch.php or (2) goto parameter to admin/login.php.
Affected Software
21 affected components
Cubecart CubeCart<=3.0.20
Cubecart CubeCart=3.0.0
Cubecart CubeCart=3.0.1
Cubecart CubeCart=3.0.2
Cubecart CubeCart=3.0.3
Cubecart CubeCart=3.0.4
Cubecart CubeCart=3.0.5
Cubecart CubeCart=3.0.6
Cubecart CubeCart=3.0.7
Cubecart CubeCart=3.0.8
Cubecart CubeCart=3.0.9
Cubecart CubeCart=3.0.10
Cubecart CubeCart=3.0.11
Cubecart CubeCart=3.0.12
Cubecart CubeCart=3.0.13
Cubecart CubeCart=3.0.14
Cubecart CubeCart=3.0.15
Cubecart CubeCart=3.0.16
Cubecart CubeCart=3.0.17
Cubecart CubeCart=3.0.18
Cubecart CubeCart=3.0.19
Event History
Feb 21, 2012
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-0865?
CVE-2012-0865 is considered a medium severity vulnerability due to its potential for phishing attacks.
2
How do I fix CVE-2012-0865?
To fix CVE-2012-0865, upgrade CubeCart to version 3.0.21 or later where this issue has been addressed.
3
What types of attacks can CVE-2012-0865 facilitate?
CVE-2012-0865 can facilitate open redirect attacks, allowing attackers to redirect users to malicious websites.
4
Which versions of CubeCart are affected by CVE-2012-0865?
CVE-2012-0865 affects CubeCart versions 3.0.20 and earlier.
5
Is user intervention needed to exploit CVE-2012-0865?
Yes, user interaction is required as an attacker needs the target to click the malicious redirect link.