CVE-2012-6342: CSRF
First published: Tue May 13 2014(Updated: )
Cross-site request forgery (CSRF) vulnerability in logout.action in Atlassian Confluence 3.4.6 allows remote attackers to hijack the authentication of administrators for requests that logout the user via a comment.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Atlassian Confluence Server and Data Server | =3.4.6 | |
| =3.4.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://archives.neohapsis.com/archives/bugtraq/2013-01/0066.html
- http://packetstormsecurity.com/files/116829/Atlassian-Confluence-3.0-Cross-Site-Request-Forgery.html
- http://www.halock.com/blog/cve-2012-6342-atlassian-confluence-multiple-cross-site-request-forgery-csrf-vulnerabilities
- http://www.securityfocus.com/archive/1/524217/30/450/threaded
- https://jira.atlassian.com/browse/CONFSERVER-22784
Frequently Asked Questions
What is the severity of CVE-2012-6342?
CVE-2012-6342 is recognized as a medium severity vulnerability due to its potential for CSRF attacks against administrator sessions.
How do I fix CVE-2012-6342?
To fix CVE-2012-6342, upgrade Atlassian Confluence to a version that addresses this CSRF vulnerability.
Who is affected by CVE-2012-6342?
CVE-2012-6342 affects users of Atlassian Confluence version 3.4.6, particularly those with administrative privileges.
What type of vulnerability is CVE-2012-6342?
CVE-2012-6342 is a Cross-Site Request Forgery (CSRF) vulnerability, allowing attackers to perform unauthorized actions on behalf of authenticated users.
What can attackers achieve with CVE-2012-6342?
Attackers can use CVE-2012-6342 to log out administrators from their sessions without their consent, disrupting their activities.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/references
- agent/first-publish-date
- agent/description
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- agent/event
- vendor/atlassian
- canonical/atlassian confluence server and data server
- version/atlassian confluence server and data server/3.4.6