CVE-2012-3384 — Cross-Site Request Forgery in Wordpress

CWE-352 — Cross-Site Request Forgery4 documents4 sources

Severity

6.8MEDIUMNVD

EPSS

0.2%

top 60.57%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Wordpress Debian Wordpress

Timeline

PublishedJul 22

Latest updateMay 17

Description

Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages3 packages

▶debiandebian/wordpress< wordpress 3.4.1+dfsg-1 (bookworm)

▶Debianwordpress/wordpress< 3.4.1+dfsg-1+3

▶NVDwordpress/wordpress3.4.0+82

🔴Vulnerability Details

GHSA

GHSA-m93w-3www-hrw9: Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3↗2022-05-17

▶

OSV

CVE-2012-3384: Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3↗2012-07-22

▶

📋Vendor Advisories

Debian

CVE-2012-3384: wordpress - Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress b...↗2012

▶