CVE-2012-3799

MediumCVSS 5.1/10Last modified Jun 16, 2026

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the Maestro module 7.x-1.x before 7.x-1.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) change workflows or (2) insert cross-site scripting (XSS) sequences.

Metrics

CVSS 2.0 5.1/10AV:N/AC:H/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://drupal.org/node/1617952Patch
http://drupal.org/node/1619830Patch, Vendor Advisory
http://drupalcode.org/project/maestro.git/commitdiff/c499971Exploit, Patch
http://secunia.com/advisories/49393Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/06/14/3
http://www.osvdb.org/82714
http://www.securityfocus.com/bid/53836
https://exchange.xforce.ibmcloud.com/vulnerabilities/76146
http://drupal.org/node/1617952Patch
http://drupal.org/node/1619830Patch, Vendor Advisory
http://drupalcode.org/project/maestro.git/commitdiff/c499971Exploit, Patch
http://secunia.com/advisories/49393Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/06/14/3
http://www.osvdb.org/82714
http://www.securityfocus.com/bid/53836
https://exchange.xforce.ibmcloud.com/vulnerabilities/76146

Timeline

Published: Jun 27, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-38002.1Cross-site scripting (XSS) vulnerability in og.js in the Organic Groups (OG) module 6.x-2.x before 6.x-2.4 for Drupal, when used with the Ve CVE-2012-38024.0Unspecified vulnerability in the Post Affiliate Pro (PAP) module for Drupal allows remote authenticated users to read the commissions of oth CVE-2012-38054.3Multiple cross-site scripting (XSS) vulnerabilities in the getAllPassedParams function in system/functions.php in Kajona before 3.4.2 allow CVE-2012-38067.5Samsung Kies before 2.5.0.12094_27_11 contains a NULL pointer dereference vulnerability which could allow remote attackers to perform a deni CVE-2012-38079.8Samsung Kies before 2.5.0.12094_27_11 has arbitrary file execution.CVE-2012-38087.5Samsung Kies before 2.5.0.12094_27_11 has arbitrary file modification.CVE-2012-38097.5Samsung Kies before 2.5.0.12094_27_11 has arbitrary directory modification.CVE-2012-38107.5Samsung Kies before 2.5.0.12094_27_11 has registry modification.CVE-2012-381110.0Unrestricted file upload vulnerability in ImageUpload.ashx in the Wallboard application in Avaya IP Office Customer Call Reporter 7.0 before CVE-2012-38124.0Double free vulnerability in apps/app_voicemail.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Certified Asterisk 1 CVE-2012-38147.5Unrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.2.4 for WordPress allows remote attackers to execute CVE-2012-38159.3Buffer overflow in RunTime.exe in Sielco Sistemi Winlog Pro SCADA before 2.07.18 and Winlog Lite SCADA before 2.07.18 allows remote attacker