Auth bypass in Ushahidi Platform
CVE-2012-3473
The (1) reports API and (2) administration feature in the comments API in the Ushahidi Platform before 2.5 do not require authentication, which allows remote attackers to generate reports and organize comments via API functions.
Vulnerability class: Broken Authentication
EPSS: 0.023 (81.8th percentile) — read the EPSS interpretation.
Affected products
- Ushahidi Ushahidi_platform — versions 1.0, 1.2, 2.0
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Exploit, Patch)
- secalert@redhat.com (mailing-list, x_refsource_MLIST)
- secalert@redhat.com (x_refsource_CONFIRM, Patch)