CVE-2012-2275

Published: Sep 15, 2012Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijack the authentication of users for requests that add, delete, or modify sensitive information, as demonstrated by changing the administrator's email via an editUser action to lib/usermanagement/userInfo.php.

Affected (17)

Products: Teamst: Testlink

1 product

Configuration A

17 vulnerable

Vulnerable Software	Affected Versions
Teamst Testlink	Up to 1.9.3
Teamst Testlink	Version 1.7.0
Teamst Testlink	Version 1.7.1
Teamst Testlink	Version 1.7.2
Teamst Testlink	Version 1.7.3
Teamst Testlink	Version 1.7.4
Teamst Testlink	Version 1.7
Teamst Testlink	Version 1.8.0
Teamst Testlink	Version 1.8.1
Teamst Testlink	Version 1.8.2
Teamst Testlink	Version 1.8.3
Teamst Testlink	Version 1.8.4
Teamst Testlink	Version 1.8
Teamst Testlink	Version 1.8 beta1
Teamst Testlink	Version 1.8 beta2
Teamst Testlink	Version 1.8 beta3
Teamst Testlink	Version 1.8 rc1

Related CWEs

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (16)

http://archives.neohapsis.com/archives/bugtraq/2012-09/0023.html

Source: cve@mitre.org

Exploit

http://gitorious.org/testlink-ga/testlink-code/commit/252788c2373e73173172ada9af661e0721599891

Source: cve@mitre.org

ExploitPatch

http://gitorious.org/testlink-ga/testlink-code/commit/2d4ac941314f8bda80e265c9de8bacf17d1cd3e6

Source: cve@mitre.org

ExploitPatch

http://gitorious.org/testlink-ga/testlink-code/commit/c8751a3c9ad8970b49d1bf882203efacd10af087

Source: cve@mitre.org

ExploitPatch

http://packetstormsecurity.org/files/116275/TestLink-1.9.3-Cross-Site-Request-Forgery.html

Source: cve@mitre.org

Exploit

http://www.exploit-db.com/exploits/21135

Source: cve@mitre.org

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/78306

Source: cve@mitre.org

https://www.htbridge.com/advisory/HTB23088

Source: cve@mitre.org

Exploit

http://archives.neohapsis.com/archives/bugtraq/2012-09/0023.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://gitorious.org/testlink-ga/testlink-code/commit/252788c2373e73173172ada9af661e0721599891

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

http://gitorious.org/testlink-ga/testlink-code/commit/2d4ac941314f8bda80e265c9de8bacf17d1cd3e6

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

http://gitorious.org/testlink-ga/testlink-code/commit/c8751a3c9ad8970b49d1bf882203efacd10af087

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

http://packetstormsecurity.org/files/116275/TestLink-1.9.3-Cross-Site-Request-Forgery.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.exploit-db.com/exploits/21135

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/78306

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.htbridge.com/advisory/HTB23088

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

Timeline

No history available yet.