CVE

Id
55558  
CVE No.
CVE-2012-2315  
Status
Candidate  
Description
admin/Auth in OpenKM 5.1.7 and other versions before 5.1.8-2 does not properly enforce privileges for changing user roles, which allows remote authenticated users to assign administrator privileges to arbitrary users via the userEdit action.  
Phase
Assigned (20120419)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
579639 55558 CVE-2012-2315 BUGTRAQ:20120103 OpenKM 5.1.7 Privilege Escalation  View
579640 55558 CVE-2012-2315 URL:http://archives.neohapsis.com/archives/bugtraq/2012-01/0007.html  View
579641 55558 CVE-2012-2315 BUGTRAQ:20120104 Re: OpenKM 5.1.7 Privilege Escalation  View
579642 55558 CVE-2012-2315 URL:http://archives.neohapsis.com/archives/bugtraq/2012-01/0021.html  View
579643 55558 CVE-2012-2315 MLIST:[oss-security] 20120323 CVE-request: OpenKM 5.1.7 Privilege Escalation / OS Command Execution (XSRF based)  View
579644 55558 CVE-2012-2315 URL:http://www.openwall.com/lists/oss-security/2012/03/23/6  View
579645 55558 CVE-2012-2315 MLIST:[oss-security] 20120323 Re: CVE-request: OpenKM 5.1.7 Privilege Escalation / OS Command Execution (XSRF based)  View
579646 55558 CVE-2012-2315 URL:http://www.openwall.com/lists/oss-security/2012/03/23/8  View
579647 55558 CVE-2012-2315 MLIST:[oss-security] 20120427 Re: CVE-request: OpenKM 5.1.7 Privilege Escalation / OS Command Execution (XSRF based)  View
579648 55558 CVE-2012-2315 URL:http://www.openwall.com/lists/oss-security/2012/04/27/6  View
579649 55558 CVE-2012-2315 MLIST:[oss-security] 20120504 Re: CVE-request: OpenKM 5.1.7 Privilege Escalation / OS Command Execution (XSRF based)  View
579650 55558 CVE-2012-2315 URL:http://www.openwall.com/lists/oss-security/2012/05/04/2  View
579651 55558 CVE-2012-2315 MLIST:[oss-security] 20120504 Re: CVE-request: OpenKM 5.1.7 Privilege Escalation / OS Command Execution (XSRF based)  View
579652 55558 CVE-2012-2315 URL:http://www.openwall.com/lists/oss-security/2012/05/04/13  View
579653 55558 CVE-2012-2315 BID:51250  View
579654 55558 CVE-2012-2315 URL:http://www.securityfocus.com/bid/51250  View
579655 55558 CVE-2012-2315 OSVDB:78105  View
579656 55558 CVE-2012-2315 URL:http://osvdb.org/78105  View
579657 55558 CVE-2012-2315 SECUNIA:47424  View
579658 55558 CVE-2012-2315 URL:http://secunia.com/advisories/47424  View
579659 55558 CVE-2012-2315 XF:openkm-userpermissions-security-bypass(72112)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
26761 JVNDB-2012-002468 ConnMan におけるアクセス制限を回避される脆弱性 ConnMan は、netlink メッセージがカーネルから発信されていることを確認しないため、アクセス制限を回避される、またはサービス運用妨害 (DoS) 状態となる脆弱性が存在します。 CVE-2012-2320 55558 7.8 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002468.html  View