CVE-2012-6342

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Cross-site request forgery (CSRF) vulnerability in logout.action in Atlassian Confluence 3.4.6 allows remote attackers to hijack the authentication of administrators for requests that logout the user via a comment.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2013-01/0066.htmlBroken Link
http://packetstormsecurity.com/files/116829/Atlassian-Confluence-3.0-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
http://www.halock.com/blog/cve-2012-6342-atlassian-confluence-multiple-cross-site-request-forgery-csrf-vulnerabilitiesExploit
http://www.securityfocus.com/archive/1/524217/30/450/threadedExploit, Third Party Advisory, VDB Entry
https://jira.atlassian.com/browse/CONFSERVER-22784Vendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2013-01/0066.htmlBroken Link
http://packetstormsecurity.com/files/116829/Atlassian-Confluence-3.0-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
http://www.halock.com/blog/cve-2012-6342-atlassian-confluence-multiple-cross-site-request-forgery-csrf-vulnerabilitiesExploit
http://www.securityfocus.com/archive/1/524217/30/450/threadedExploit, Third Party Advisory, VDB Entry
https://jira.atlassian.com/browse/CONFSERVER-22784Vendor Advisory

Timeline

Published: May 13, 2014
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-63446.1Novell ZENworks Configuration Management before 11.2.4 allows XSS.CVE-2012-63457.5Novell ZENworks Configuration Management before 11.2.4 allows obtaining sensitive trace information.CVE-2012-63466.1Multiple cross-site scripting (XSS) vulnerabilities in FortiWeb before 4.4.4 allow remote attackers to inject arbitrary web script or HTML v CVE-2012-63476.1Multiple cross-site scripting (XSS) vulnerabilities in Java number format exception handling in FortiGate FortiDB before 4.4.2 allow remote CVE-2012-63483.3Centrify Deployment Manager 2.1.0.283, as distributed in Centrify Suite before 2012.5, allows local users to (1) overwrite arbitrary files v CVE-2012-63499.3Buffer overflow in the .mdb parser in Autonomy KeyView IDOL, as used in IBM Notes 8.5.x before 8.5.3 FP4, allows remote attackers to execute CVE-2012-63504.3Cross-site scripting (XSS) vulnerability in the Web component in IBM Cognos TM1 before 9.5.2 FP3 and 10.1 before 10.1 FP1 allows remote atta CVE-2012-63525.0The Session Manager in IBM Sterling Connect:Direct through 4.1.0.3 on UNIX allows remote attackers to cause a denial of service (daemon cras CVE-2012-63547.5The management GUI on the IBM SAN Volume Controller and Storwize V7000 6.x before 6.4.1.3 allows remote attackers to bypass authentication a CVE-2012-63556.5IBM Maximo Asset Management 6.2 through 7.5, Maximo Asset Management Essentials 6.2 through 7.5, Tivoli Asset Management for IT 6.2 through CVE-2012-63566.5IBM Maximo Asset Management 7.5, Maximo Asset Management Essentials 7.5, and SmartCloud Control Desk 7.5 allow remote authenticated users to CVE-2012-63576.5IBM Maximo Asset Management 7.5, Maximo Asset Management Essentials 7.5, and SmartCloud Control Desk 7.5 allow remote authenticated users to