CVE-2012-1297: CSRF
Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) delete users via a delete action in the user module, (2) delete news via a delete action in the news module, or (3) delete newsletters via a delete action in the newsletters module.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1297?
CVE-2012-1297 has a medium severity rating due to its potential to allow unauthorized actions by exploiting cross-site request forgery (CSRF).
How do I fix CVE-2012-1297?
To fix CVE-2012-1297, update to a version of Contao CMS greater than 2.11.0 that addresses the CSRF vulnerabilities.
What type of attacks can CVE-2012-1297 facilitate?
CVE-2012-1297 can facilitate unauthorized actions such as user deletion and content manipulation through CSRF attacks.
What affected versions are vulnerable to CVE-2012-1297?
CVE-2012-1297 affects Contao CMS versions 2.11.0 and earlier.
Is CVE-2012-1297 a common vulnerability?
CVE-2012-1297 is a well-known CSRF vulnerability that is important to address in any affected implementations to secure the application.