CVE-2012-4234: XSS
First published: Thu Sep 04 2014(Updated: )
Cross-site scripting (XSS) vulnerability in the group moderation screen in the control center (control.php) in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via the group parameter.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Phorum | <=5.2.18 | |
| Phorum | =5.2 | |
| Phorum | =5.2.1 | |
| Phorum | =5.2.10 | |
| Phorum | =5.2.10-rc1 | |
| Phorum | =5.2.11 | |
| Phorum | =5.2.12 | |
| Phorum | =5.2.12-a | |
| Phorum | =5.2.13 | |
| Phorum | =5.2.14 | |
| Phorum | =5.2.15 | |
| Phorum | =5.2.15-a | |
| Phorum | =5.2.16 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://archives.neohapsis.com/archives/bugtraq/2012-08/0189.html
- http://packetstormsecurity.org/files/116057/Phorum-5.2.18-Cross-Site-Scripting.html
- http://secunia.com/advisories/50445
- http://www.phorum.org/phorum5/read.php?64,151943
- http://www.securityfocus.com/bid/55275
- https://exchange.xforce.ibmcloud.com/vulnerabilities/78124
- https://www.htbridge.com/advisory/HTB23109
- http://www.phorum.org/phorum5/read.php?64%2C151943
Frequently Asked Questions
What is the severity of CVE-2012-4234?
CVE-2012-4234 is classified as a medium severity Cross-Site Scripting (XSS) vulnerability.
How do I fix CVE-2012-4234?
To fix CVE-2012-4234, upgrade Phorum to version 5.2.19 or later.
Who is affected by CVE-2012-4234?
CVE-2012-4234 affects all versions of Phorum prior to 5.2.19.
What types of attacks can CVE-2012-4234 facilitate?
CVE-2012-4234 can facilitate remote attackers in injecting arbitrary web scripts or HTML.
Where in Phorum does CVE-2012-4234 exist?
CVE-2012-4234 exists in the group moderation screen of the control center in Phorum.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/author
- agent/last-modified-date
- agent/remedy
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/weakness
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/phorum
- canonical/phorum
- version/phorum/5.2.18
- version/phorum/5.2
- version/phorum/5.2.1
- version/phorum/5.2.10
- version/phorum/5.2.10-rc1
- version/phorum/5.2.11
- version/phorum/5.2.12
- version/phorum/5.2.12-a
- version/phorum/5.2.13
- version/phorum/5.2.14
- version/phorum/5.2.15
- version/phorum/5.2.15-a
- version/phorum/5.2.16