CVE-2012-2999: CSRF

Q: What is the severity of CVE-2012-2999?

CVE-2012-2999 is classified as a medium severity vulnerability due to the potential for cross-site request forgery (CSRF) attacks affecting the authentication of administrators.

Q: How do I fix CVE-2012-2999?

To fix CVE-2012-2999, upgrade to Cerberus FTP Server version 5.0.5.0 or later which addresses these CSRF vulnerabilities.

Q: What types of exploits are possible with CVE-2012-2999?

CVE-2012-2999 allows attackers to hijack administrator sessions, facilitating unauthorized actions such as adding user accounts or altering FTP service configurations.

Q: Which versions of Cerberus FTP Server are affected by CVE-2012-2999?

CVE-2012-2999 affects all versions of Cerberus FTP Server prior to 5.0.5.0.

Q: Is user interaction required to exploit CVE-2012-2999?

Exploitation of CVE-2012-2999 does not require user interaction, making it a serious threat to administrator accounts.

Published Oct 4, 2012

Updated

Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in Cerberus FTP Server before 5.0.5.0 allow remote attackers to hijack the authentication of administrators for requests that (1) add a user account or (2) reconfigure the state of the FTP service, as demonstrated by a request to usermanager/users/modify.

Affected Software

97 affected components

Cerberusftp Ftp Server<=5.0.4.3

Cerberusftp Ftp Server=1.0

Cerberusftp Ftp Server=1.01

Cerberusftp Ftp Server=1.1

Cerberusftp Ftp Server=1.2

Cerberusftp Ftp Server=1.02

Cerberusftp Ftp Server=1.03

Cerberusftp Ftp Server=1.5

Cerberusftp Ftp Server=1.05

Cerberusftp Ftp Server=1.6-beta

Cerberusftp Ftp Server=1.7

Cerberusftp Ftp Server=1.22

Cerberusftp Ftp Server=1.71

Cerberusftp Ftp Server=2.0

Cerberusftp Ftp Server=2.0-beta1

Cerberusftp Ftp Server=2.0-beta2

Cerberusftp Ftp Server=2.0-beta3

Cerberusftp Ftp Server=2.0-beta4

Cerberusftp Ftp Server=2.1

Cerberusftp Ftp Server=2.01

Cerberusftp Ftp Server=2.02

Cerberusftp Ftp Server=2.2

Cerberusftp Ftp Server=2.02-beta

Cerberusftp Ftp Server=2.2-beta1

Cerberusftp Ftp Server=2.2-beta2

Cerberusftp Ftp Server=2.2-beta3

Cerberusftp Ftp Server=2.3

Cerberusftp Ftp Server=2.4

Cerberusftp Ftp Server=2.4-beta1

Cerberusftp Ftp Server=2.4-beta2

Cerberusftp Ftp Server=2.4-beta3

Cerberusftp Ftp Server=2.11

Cerberusftp Ftp Server=2.11-beta

Cerberusftp Ftp Server=2.11-beta2

Cerberusftp Ftp Server=2.15

Cerberusftp Ftp Server=2.15-beta

Cerberusftp Ftp Server=2.16

Cerberusftp Ftp Server=2.21

Cerberusftp Ftp Server=2.22

Cerberusftp Ftp Server=2.23-beta

Cerberusftp Ftp Server=2.31

Cerberusftp Ftp Server=2.32

Cerberusftp Ftp Server=2.41

Cerberusftp Ftp Server=2.42

Cerberusftp Ftp Server=2.43

Cerberusftp Ftp Server=2.44

Cerberusftp Ftp Server=2.45

Cerberusftp Ftp Server=2.46

Cerberusftp Ftp Server=2.47

Cerberusftp Ftp Server=2.48

Cerberusftp Ftp Server=2.49

Cerberusftp Ftp Server=2.50

Cerberusftp Ftp Server=3.0

Cerberusftp Ftp Server=3.0.1

Cerberusftp Ftp Server=3.0.2

Cerberusftp Ftp Server=3.0.3

Cerberusftp Ftp Server=3.0.4

Cerberusftp Ftp Server=3.0.5

Cerberusftp Ftp Server=3.0.6

Cerberusftp Ftp Server=3.0.7

Cerberusftp Ftp Server=3.0.7.1

Cerberusftp Ftp Server=3.0.8

Cerberusftp Ftp Server=3.1

Cerberusftp Ftp Server=3.1.0.3

Cerberusftp Ftp Server=3.1.0.4

Cerberusftp Ftp Server=3.1.0.5

Cerberusftp Ftp Server=3.1.1

Cerberusftp Ftp Server=3.1.2

Cerberusftp Ftp Server=3.1.3

Cerberusftp Ftp Server=3.1.3.1

Cerberusftp Ftp Server=3.1.4

Cerberusftp Ftp Server=4.0.0

Cerberusftp Ftp Server=4.0.0.6

Cerberusftp Ftp Server=4.0.0.8

Cerberusftp Ftp Server=4.0.0.9

Cerberusftp Ftp Server=4.0.0.11

Cerberusftp Ftp Server=4.0.1

Cerberusftp Ftp Server=4.0.1.1

Cerberusftp Ftp Server=4.0.2

Cerberusftp Ftp Server=4.0.2.2

Cerberusftp Ftp Server=5.0.0.0

Cerberusftp Ftp Server=5.0.0.1

Cerberusftp Ftp Server=5.0.0.2

Cerberusftp Ftp Server=5.0.0.3

Cerberusftp Ftp Server=5.0.0.4

Cerberusftp Ftp Server=5.0.0.5

Cerberusftp Ftp Server=5.0.0.6

Cerberusftp Ftp Server=5.0.0.7

Cerberusftp Ftp Server=5.0.1.0

Cerberusftp Ftp Server=5.0.1.1

Cerberusftp Ftp Server=5.0.1.2

Cerberusftp Ftp Server=5.0.2.0

Cerberusftp Ftp Server=5.0.3.0

Cerberusftp Ftp Server=5.0.3.1

Cerberusftp Ftp Server=5.0.4.0

Cerberusftp Ftp Server=5.0.4.1

Cerberusftp Ftp Server=5.0.4.2

Event History

Oct 4, 2012

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-2999?

CVE-2012-2999 is classified as a medium severity vulnerability due to the potential for cross-site request forgery (CSRF) attacks affecting the authentication of administrators.

How do I fix CVE-2012-2999?

To fix CVE-2012-2999, upgrade to Cerberus FTP Server version 5.0.5.0 or later which addresses these CSRF vulnerabilities.

What types of exploits are possible with CVE-2012-2999?