CVE-2012-2734
published 2012-09-28CVE-2012-2734: Multiple cross-site request forgery (CSRF) vulnerabilities in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0…
PriorityP427medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
0.92%
56.2th percentile
Multiple cross-site request forgery (CSRF) vulnerabilities in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allow remote attackers to hijack the authentication of arbitrary users for requests that execute commands via unspecified vectors.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_mrg | — | — |
| trevor_mckay | cumin | <= 0.1.5192-4 | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
| trevor_mckay | cumin | — | — |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
cumin: CSRF flaw
vendor_redhat·2012-09-19·CVSS 6.8
CVE-2012-2734 [MEDIUM] CWE-352 cumin: CSRF flaw
cumin: CSRF flaw
Multiple cross-site request forgery (CSRF) vulnerabilities in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allow remote attackers to hijack the authentication of arbitrary users for requests that execute commands via unspecified vectors.
Package: cumin (Red Hat Enterprise MRG 1) - Will not fix
GHSA
GHSA-jvfp-hmwp-7chr: Multiple cross-site request forgery (CSRF) vulnerabilities in Cumin before 0
ghsa_unreviewed·2022-05-13
CVE-2012-2734 [MEDIUM] CWE-352 GHSA-jvfp-hmwp-7chr: Multiple cross-site request forgery (CSRF) vulnerabilities in Cumin before 0
Multiple cross-site request forgery (CSRF) vulnerabilities in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allow remote attackers to hijack the authentication of arbitrary users for requests that execute commands via unspecified vectors.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-2680 CVE-2012-2681 CVE-2012-2683 CVE-2012-2684 CVE-2012-2685 CVE-2012-2734 CVE-2012-2735 CVE-2012-3459 cumin various flaws [fedora-all]
bugzilla·2012-09-19·CVSS 5.0
CVE-2012-2680 [MEDIUM] CVE-2012-2680 CVE-2012-2681 CVE-2012-2683 CVE-2012-2684 CVE-2012-2685 CVE-2012-2734 CVE-2012-2735 CVE-2012-3459 cumin various flaws [fedora-all]
CVE-2012-2680 CVE-2012-2681 CVE-2012-2683 CVE-2012-2684 CVE-2012-2685 CVE-2012-2734 CVE-2012-2735 CVE-2012-3459 cumin various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submiss
Bugzilla
CVE-2012-2734 cumin: CSRF flaw
bugzilla·2012-06-14·CVSS 6.8
CVE-2012-2734 [MEDIUM] CVE-2012-2734 cumin: CSRF flaw
CVE-2012-2734 cumin: CSRF flaw
Florian Weimer found that Cumin did not protect against CSRF (Cross-Site Request Forgery) attacks. If an authenticated user logged into a Cumin web site visited a specially-crafted web page, it could lead to the unauthorized command execution in the Cumin site with the privileges of the logged-in user.
Discussion:
Created attachment 598739
Patch to embed id (associated with login) in all forms to combat CSRF
---
This patch should add CSRF protection. A unique id (generated from the same source that generates session ids) is embedded in the rendering of every descendent of the Form class, unconditionally.
The unique id is stored in the login record for the session and compared against the value in a POST request. The name of the csrf token is based on th
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=832124http://rhn.redhat.com/errata/RHSA-2012-1278.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1281.htmlhttp://secunia.com/advisories/50660http://www.securityfocus.com/bid/55618https://exchange.xforce.ibmcloud.com/vulnerabilities/78775http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=832124http://rhn.redhat.com/errata/RHSA-2012-1278.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1281.htmlhttp://secunia.com/advisories/50660http://www.securityfocus.com/bid/55618https://exchange.xforce.ibmcloud.com/vulnerabilities/78775
2012-09-28
Published