Unscored severity · published May 13, 2014
CVE-2012-6342
Cross-site request forgery (CSRF) vulnerability in logout.action in Atlassian Confluence 3.4.6 allows remote attackers to hijack the authentication of administrators for requests…
–
CVSS
1.7%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in logout.action in Atlassian Confluence 3.4.6 allows remote attackers to hijack the authentication of administrators for requests that logout the user via a comment.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Confluence · Atlassian
3.4.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-6342
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-6342
Broken Link
http://archives.neohapsis.com/archives/bugtraq/2013-01/0066.html
Exploit
http://packetstormsecurity.com/files/116829/Atlassian-Confluence-3.0-Cross-Site-Request-Forgery.html
Exploit
http://www.halock.com/blog/cve-2012-6342-atlassian-confluence-multiple-cross-site-request-forgery-csrf-vulnerabilities
Exploit
http://www.securityfocus.com/archive/1/524217/30/450/threaded
Vendor Advisory
https://jira.atlassian.com/browse/CONFSERVER-22784
More from Confluence
9.8
CVE-2023-22527
Atlassian Confluence Data Center and Server Template Injection Vulnerability
9.8
CVE-2023-22518
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
9.8
CVE-2023-22515
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
9.8
CVE-2022-26138
Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
9.8
CVE-2022-26134
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability