CVE-2012-4568

HighCVSS 8.8/10Last modified Jun 16, 2026

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in LetoDMS (formerly MyDMS) before 3.3.8 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://sourceforge.net/p/mydms/code/HEAD/tree/trunk/CHANGELOGRelease Notes, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/10/06/1Mailing List, Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2012/10/31/7Mailing List, Third Party Advisory, VDB Entry
http://sourceforge.net/p/mydms/code/HEAD/tree/trunk/CHANGELOGRelease Notes, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/10/06/1Mailing List, Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2012/10/31/7Mailing List, Third Party Advisory, VDB Entry

Timeline

Published: Oct 23, 2017
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-45696.1Multiple cross-site scripting (XSS) vulnerabilities in out/out.UsrMgr.php in LetoDMS (formerly MyDMS) before 3.3.9 allow remote attackers to CVE-2012-45709.8SQL injection vulnerability in LetoDMS_Core/Core/inc.ClassDMS.php in LetoDMS (formerly MyDMS) before 3.3.8 allows remote attackers to execut CVE-2012-45712.1Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier f CVE-2012-45723.7Red Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom CVE-2012-45735.5The v1 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protec CVE-2012-45745.5A flaw was found in Pulp, as used in Red Hat CloudForms. This vulnerability allows a local user to read the administrative password due to w CVE-2012-45755.0The add_database function in objects.c in the pgbouncer pooler 1.5.2 for PostgreSQL allows remote attackers to cause a denial of service (da CVE-2012-45767.8FreeBSD: Input Validation Flaw allows local users to gain elevated privileges CVE-2012-457710.0The Linux firmware image on (1) Korenix Jetport 5600 series serial-device servers and (2) ORing Industrial DIN-Rail serial-device servers ha CVE-2012-45782.1The geli encryption provider 7 before r239184 on FreeBSD 10 uses a weak Master Key, which makes it easier for local users to defeat a crypto CVE-2012-45793.5Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary CVE-2012-45804.3Cross-site scripting (XSS) vulnerability in McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Em