CVE-2012-2380: CSRF
Multiple cross-site request forgery (CSRF) vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 allow remote attackers to hijack the authentication of admins or editors by leveraging the HTTP POST functionality.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2380?
CVE-2012-2380 is considered a moderate severity vulnerability due to its potential impact on authentication hijacking for admins or editors.
How do I fix CVE-2012-2380?
To fix CVE-2012-2380, upgrade Apache Roller to version 5.0.1 or later.
Who is affected by CVE-2012-2380?
CVE-2012-2380 affects versions of Apache Roller prior to 5.0.1, including multiple earlier versions.
What kind of attacks can CVE-2012-2380 enable?
CVE-2012-2380 allows remote attackers to perform cross-site request forgery (CSRF) attacks leading to potential authentication hijacking.
Is there a workaround for CVE-2012-2380 before applying a patch?
A suitable workaround for CVE-2012-2380 involves implementing CSRF protections at the application layer to mitigate attack vectors until a patch is applied.