CVE-2012-0829

Mibew Messenger < 1.6.4 - Cross-Site Request Forgery via Multiple Parameters

Title source: llm
STIX 2.1

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in Mibew Messenger 1.6.4 and earlier allow remote attackers to hijack the authentication of operators for requests that insert cross-site scripting (XSS) sequences via the (1) address or (2) threadid parameters to operator/ban.php; or (3) geolinkparams, (4) title, or (5) chattitle parameters to operator/settings.php.

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/72822
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/47787
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/51723
Exploit mailing-list x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2012-01/0178.html
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/02/02/10

Scores

EPSS 0.0089
EPSS Percentile 55.2%

Details

CWE
CWE-352
Status published
Products (16)
mibew/mibew_messenger 1.0.6
mibew/mibew_messenger 1.0.7
mibew/mibew_messenger 1.0.8
mibew/mibew_messenger 1.0.9
mibew/mibew_messenger 1.0.10
mibew/mibew_messenger 1.4.0
mibew/mibew_messenger 1.4.1
mibew/mibew_messenger 1.4.2
mibew/mibew_messenger 1.5.0
mibew/mibew_messenger 1.5.1
... and 6 more
Published Feb 14, 2012
Tracked Since Feb 18, 2026