Vanilla Forums Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-4954)

Description

The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value during a man-in-the-middle attack, related to a "parameter manipulation" issue.

Remediation

References

CVE-2012-4954

Related Vulnerabilities

WordPress Plugin Limit Login Attempts Reloaded Security Bypass (2.17.3)

WordPress Plugin Quotes and Tips by BestWebSoft Cross-Site Scripting (1.32)

Apache HTTP Server Out-of-bounds Write Vulnerability (CVE-2004-0488)

Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-2196)

WordPress Plugin Starter Templates-Elementor, WordPress & Beaver Builder Templates Security Bypass (2.7.0)

Severity

Low

Classification

CVE-2012-4954 CWE-264