CVE-2012-1248

app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hijack sessions by leveraging administrative access to a different domain.

CVSS v2.0 5.1 MEDIUM

5.1^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:H/Au:N/C:P/I:P/A:P

Exploitability : 4.9 / Impact : 6.4

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://basercms.net/security/1	Vendor Advisory
http://jvn.jp/en/jp/JVN53465692/index.html	Third Party Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2012-000043	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/53543	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/75660	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:basercms:basercms::::::::
	cpe:2.3:a:basercms:basercms:1.5.4:::::::*
	cpe:2.3:a:basercms:basercms:1.5.5:::::::*
	cpe:2.3:a:basercms:basercms:1.5.6:::::::*
	cpe:2.3:a:basercms:basercms:1.5.7:::::::*
	cpe:2.3:a:basercms:basercms:1.5.8:::::::*
	cpe:2.3:a:basercms:basercms:1.5.9:::::::*
	cpe:2.3:a:basercms:basercms:1.6.0:::::::*
	cpe:2.3:a:basercms:basercms:1.6.1:::::::*
	cpe:2.3:a:basercms:basercms:1.6.2:::::::*
	cpe:2.3:a:basercms:basercms:1.6.3:::::::*
	cpe:2.3:a:basercms:basercms:1.6.4:::::::*
	cpe:2.3:a:basercms:basercms:1.6.5:::::::*
	cpe:2.3:a:basercms:basercms:1.6.6:::::::*
	cpe:2.3:a:basercms:basercms:1.6.7:::::::*
	cpe:2.3:a:basercms:basercms:1.6.7.1:::::::*
	cpe:2.3:a:basercms:basercms:1.6.8:::::::*
	cpe:2.3:a:basercms:basercms:1.6.9:::::::*
	cpe:2.3:a:basercms:basercms:1.6.9.1:::::::*
	cpe:2.3:a:basercms:basercms:1.6.10:::::::*
	cpe:2.3:a:basercms:basercms:1.6.11:::::::*
	cpe:2.3:a:basercms:basercms:1.6.11.1:::::::*
	cpe:2.3:a:basercms:basercms:1.6.11.2:::::::*
	cpe:2.3:a:basercms:basercms:1.6.11.3:::::::*
	cpe:2.3:a:basercms:basercms:1.6.11.4:::::::*
	cpe:2.3:a:basercms:basercms:1.6.12:::::::*
	cpe:2.3:a:basercms:basercms:1.6.13:::::::*
	cpe:2.3:a:basercms:basercms:1.6.13.1:::::::*
	cpe:2.3:a:basercms:basercms:1.6.13.6:::::::*
	cpe:2.3:a:basercms:basercms:1.6.14:::::::*

History

14 Sep 2021, 12:10

Type	Values Removed	Values Added
References	~~(BID) http://www.securityfocus.com/bid/53543 -~~	(BID) http://www.securityfocus.com/bid/53543 - Third Party Advisory, VDB Entry
References	~~(XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/75660 -~~	(XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/75660 - Third Party Advisory, VDB Entry
References	~~(JVNDB) http://jvndb.jvn.jp/jvndb/JVNDB-2012-000043 -~~	(JVNDB) http://jvndb.jvn.jp/jvndb/JVNDB-2012-000043 - Third Party Advisory, VDB Entry
References	~~(JVN) http://jvn.jp/en/jp/JVN53465692/index.html -~~	(JVN) http://jvn.jp/en/jp/JVN53465692/index.html - Third Party Advisory

15 Jul 2021, 14:24

Type	Values Removed	Values Added
CPE	cpe:2.3:a:e-catchup:basercms:1.6.0:::::::* cpe:2.3:a:e-catchup:basercms:1.6.13.1:::::::* cpe:2.3:a:e-catchup:basercms:1.5.4:::::::* cpe:2.3:a:e-catchup:basercms:1.6.5:::::::* cpe:2.3:a:e-catchup:basercms:1.6.11.2:::::::* cpe:2.3:a:e-catchup:basercms:1.5.5:::::::* cpe:2.3:a:e-catchup:basercms:1.6.13.6:::::::* cpe:2.3:a:e-catchup:basercms:1.6.11:::::::* cpe:2.3:a:e-catchup:basercms:1.6.13:::::::* cpe:2.3:a:e-catchup:basercms:1.6.9.1:::::::* cpe:2.3:a:e-catchup:basercms:1.6.2:::::::* cpe:2.3:a:e-catchup:basercms:1.5.8:::::::* cpe:2.3:a:e-catchup:basercms:1.6.11.4:::::::* cpe:2.3:a:e-catchup:basercms:::::::: cpe:2.3:a:e-catchup:basercms:1.6.9:::::::* cpe:2.3:a:e-catchup:basercms:1.6.1:::::::* cpe:2.3:a:e-catchup:basercms:1.5.9:::::::* cpe:2.3:a:e-catchup:basercms:1.6.6:::::::* cpe:2.3:a:e-catchup:basercms:1.6.11.1:::::::* cpe:2.3:a:e-catchup:basercms:1.5.6:::::::* cpe:2.3:a:e-catchup:basercms:1.6.10:::::::* cpe:2.3:a:e-catchup:basercms:1.6.12:::::::* cpe:2.3:a:e-catchup:basercms:1.6.11.3:::::::* cpe:2.3:a:e-catchup:basercms:1.6.7.1:::::::* cpe:2.3:a:e-catchup:basercms:1.6.4:::::::* cpe:2.3:a:e-catchup:basercms:1.5.7:::::::* cpe:2.3:a:e-catchup:basercms:1.6.8:::::::* cpe:2.3:a:e-catchup:basercms:1.6.3:::::::* cpe:2.3:a:e-catchup:basercms:1.6.7:::::::* cpe:2.3:a:e-catchup:basercms:1.6.14:::::::*	cpe:2.3:a:basercms:basercms:1.6.8:::::::* cpe:2.3:a:basercms:basercms:::::::: cpe:2.3:a:basercms:basercms:1.6.2:::::::* cpe:2.3:a:basercms:basercms:1.6.9:::::::* cpe:2.3:a:basercms:basercms:1.6.7:::::::* cpe:2.3:a:basercms:basercms:1.6.11.3:::::::* cpe:2.3:a:basercms:basercms:1.6.4:::::::* cpe:2.3:a:basercms:basercms:1.6.11:::::::* cpe:2.3:a:basercms:basercms:1.6.13:::::::* cpe:2.3:a:basercms:basercms:1.6.7.1:::::::* cpe:2.3:a:basercms:basercms:1.5.5:::::::* cpe:2.3:a:basercms:basercms:1.5.7:::::::* cpe:2.3:a:basercms:basercms:1.6.11.4:::::::* cpe:2.3:a:basercms:basercms:1.6.10:::::::* cpe:2.3:a:basercms:basercms:1.5.4:::::::* cpe:2.3:a:basercms:basercms:1.5.8:::::::* cpe:2.3:a:basercms:basercms:1.5.9:::::::* cpe:2.3:a:basercms:basercms:1.6.13.1:::::::* cpe:2.3:a:basercms:basercms:1.6.12:::::::* cpe:2.3:a:basercms:basercms:1.5.6:::::::* cpe:2.3:a:basercms:basercms:1.6.1:::::::* cpe:2.3:a:basercms:basercms:1.6.3:::::::* cpe:2.3:a:basercms:basercms:1.6.11.2:::::::* cpe:2.3:a:basercms:basercms:1.6.0:::::::* cpe:2.3:a:basercms:basercms:1.6.9.1:::::::* cpe:2.3:a:basercms:basercms:1.6.11.1:::::::* cpe:2.3:a:basercms:basercms:1.6.5:::::::* cpe:2.3:a:basercms:basercms:1.6.14:::::::* cpe:2.3:a:basercms:basercms:1.6.13.6:::::::* cpe:2.3:a:basercms:basercms:1.6.6:::::::*

Information

Published : 2012-05-15 20:55

Updated : 2024-02-04 18:16

NVD link : CVE-2012-1248

Mitre link : CVE-2012-1248

CVE.ORG link : CVE-2012-1248

JSON object : View

Products Affected

basercms

basercms

CWE

CWE-264

Permissions, Privileges, and Access Controls

5.1 /10