CVE-2012-2316: CSRF

Published Sep 9, 2012

Updated

Cross-site request forgery (CSRF) vulnerability in servlet/admin/AuthServlet.java in OpenKM 5.1.7 and other versions before 5.1.8-2 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary code via the script parameter to admin/scripting.jsp.

Affected Software

2 affected components

OpenKM OpenKM=5.1.7

OpenKM OpenKM=5.1.8

Event History

Sep 9, 2012

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-2316?

CVE-2012-2316 is classified as a medium severity vulnerability due to its potential for exploitation through cross-site request forgery.

How do I fix CVE-2012-2316?

To fix CVE-2012-2316, upgrade OpenKM to version 5.1.8-2 or later to mitigate the vulnerability.

What systems are affected by CVE-2012-2316?

CVE-2012-2316 affects OpenKM versions 5.1.7 and earlier models up to 5.1.8-1.

What type of vulnerability is CVE-2012-2316?

CVE-2012-2316 is a cross-site request forgery (CSRF) vulnerability that allows attackers to hijack user authentication.

Can CVE-2012-2316 allow code execution?

Yes, CVE-2012-2316 can enable attackers to execute arbitrary code through compromised administrator requests.