Unscored severity · published Mar 19, 2012
CVE-2012-1297
Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attackers to hijack the authentication of…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) delete users via a delete action in the user module, (2) delete news via a delete action in the news module, or (3) delete newsletters via a delete action in the newsletters module.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Contao Cms · Contao
through 2.11.0; 2.0; 2.0; 2.0; 2.1.0; 2.1.1; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-1297
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-1297
ivanobinetti.blogspot.com
http://ivanobinetti.blogspot.com/2012/02/contaocms-fka-typolight-211-csrf-delete.html
Exploit
http://packetstormsecurity.org/files/110214/ContaoCMS-2.11.0-Cross-Site-Request-Forgery.html
Vendor Advisory
http://secunia.com/advisories/48180
Exploit
http://www.exploit-db.com/exploits/18527
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/73479
More from Contao Cms
9.8
CVE-2014-1860
Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities
9.8
CVE-2017-16558
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module
9.8
CVE-2019-10643
Contao 4.7 allows Use of a Key Past its Expiration Date
9.8
CVE-2019-10641
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password
8.8
CVE-2019-10642
Contao 4.7 allows CSRF