CVE-2012-2680
published 2012-09-28CVE-2012-2680: Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, does not properly restrict access to resources, which allows…
PriorityP424medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
2.34%
81.7th percentile
Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, does not properly restrict access to resources, which allows remote attackers to obtain sensitive information via unspecified vectors related to (1) "web pages," (2) "export functionality," and (3) "image viewing."
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_mrg | — | — |
| trevor_mckay | cumin | <= 0.1.5192-4 | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-ggx8-566c-mc69: Cumin before 0
ghsa_unreviewed·2022-05-13
CVE-2012-2680 [MEDIUM] GHSA-ggx8-566c-mc69: Cumin before 0
Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, does not properly restrict access to resources, which allows remote attackers to obtain sensitive information via unspecified vectors related to (1) "web pages," (2) "export functionality," and (3) "image viewing."
Red Hat
cumin: authentication bypass flaws
vendor_redhat·2012-09-19·CVSS 5.0
CVE-2012-2680 [MEDIUM] cumin: authentication bypass flaws
cumin: authentication bypass flaws
Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, does not properly restrict access to resources, which allows remote attackers to obtain sensitive information via unspecified vectors related to (1) "web pages," (2) "export functionality," and (3) "image viewing."
Package: cumin (Red Hat Enterprise MRG 1) - Will not fix
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-2680 CVE-2012-2681 CVE-2012-2683 CVE-2012-2684 CVE-2012-2685 CVE-2012-2734 CVE-2012-2735 CVE-2012-3459 cumin various flaws [fedora-all]
bugzilla·2012-09-19·CVSS 5.0
CVE-2012-2680 [MEDIUM] CVE-2012-2680 CVE-2012-2681 CVE-2012-2683 CVE-2012-2684 CVE-2012-2685 CVE-2012-2734 CVE-2012-2735 CVE-2012-3459 cumin various flaws [fedora-all]
CVE-2012-2680 CVE-2012-2681 CVE-2012-2683 CVE-2012-2684 CVE-2012-2685 CVE-2012-2734 CVE-2012-2735 CVE-2012-3459 cumin various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submiss
Bugzilla
CVE-2012-2680 cumin: authentication bypass flaws
bugzilla·2012-06-06·CVSS 5.0
CVE-2012-2680 [MEDIUM] CVE-2012-2680 cumin: authentication bypass flaws
CVE-2012-2680 cumin: authentication bypass flaws
Florian Weimer reported multiple instances of unprotected access (web pages, export functionality, image viewing) in cumin. An unauthenticated user could view pages that should have been restricted to authenticated users only, resulting in information disclosure.
Discussion:
Fixed in revision 5398 on trunk.
Essentially, a fragment from the existing authentication check on the index.html page has been added to all widgets. The check can be enabled or disabled, and is disabled by default. For widgets in the page hierarchy, the check is enabled except where necessary for actual login -- the login page itself, and the css and resource pages which allow it to draw.
Here is the diff from the commit email for reference:
Modified: trunk/cumin/
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=829421http://rhn.redhat.com/errata/RHSA-2012-1278.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1281.htmlhttp://secunia.com/advisories/50660http://www.securityfocus.com/bid/55618https://exchange.xforce.ibmcloud.com/vulnerabilities/78770http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=829421http://rhn.redhat.com/errata/RHSA-2012-1278.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1281.htmlhttp://secunia.com/advisories/50660http://www.securityfocus.com/bid/55618https://exchange.xforce.ibmcloud.com/vulnerabilities/78770
2012-09-28
Published