{"api_version":"1","generated_at":"2026-07-23T07:10:01+00:00","cve":"CVE-2012-4773","urls":{"html":"https://cve.report/CVE-2012-4773","api":"https://cve.report/api/cve/CVE-2012-4773.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2012-4773","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-4773"},"summary":{"title":"CVE-2012-4773","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to hijack the authentication of administrators for requests that add, delete, or modify sensitive information, as demonstrated by adding an administrator account via an add action to admin/accounts/add/.","state":"PUBLISHED","assigner":"mitre","published_at":"2012-10-22 23:55:08","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-352","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/79469","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/79469","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5106.php","name":"http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5106.php","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Zero Science Lab » Subrion CMS 2.2.1 CSRF Add Admin Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.org/files/117460/Subrion-CMS-2.2.1-XSS-CSRF-SQL-Injection.html","name":"http://packetstormsecurity.org/files/117460/Subrion-CMS-2.2.1-XSS-CSRF-SQL-Injection.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Subrion CMS 2.2.1 XSS / CSRF / SQL Injection ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/85999","name":"http://www.osvdb.org/85999","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://packetstormsecurity.org/files/116433","name":"http://packetstormsecurity.org/files/116433","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Subrion CMS 2.2.1 Cross Site Request Forgery ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.subrion.com/forums/announcements/934-subrion-2-2-3-open-source-cms-core-available.html","name":"http://www.subrion.com/forums/announcements/934-subrion-2-2-3-open-source-cms-core-available.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Subrion 2.2.3 Open Source CMS core is available! - Subrion CMS User Forums","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.htbridge.com/advisory/HTB23113","name":"https://www.htbridge.com/advisory/HTB23113","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"File Not Found","mime":"text/html","httpstatus":"404","archivestatus":"403"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/78469","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/78469","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://archives.neohapsis.com/archives/bugtraq/2012-10/0096.html","name":"http://archives.neohapsis.com/archives/bugtraq/2012-10/0096.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"","mime":"","httpstatus":"-1","archivestatus":"404"},{"url":"http://secunia.com/advisories/51013","name":"http://secunia.com/advisories/51013","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Security Advisory SA51013 - Subrion CMS Cross-Site Scripting and SQL Injection vulnerabilities - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-4773","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4773","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2012","cve_id":"4773","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"intelliants","cpe5":"subrion_cms","cpe6":"2.0.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"4773","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"intelliants","cpe5":"subrion_cms","cpe6":"2.2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"4773","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"intelliants","cpe5":"subrion_cms","cpe6":"2.2.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"4773","vulnerable":"1","versionEndIncluding":"2.2.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"intelliants","cpe5":"subrion_cms","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T20:42:55.121Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20121017 Multiple vulnerabilities in Subrion CMS","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://archives.neohapsis.com/archives/bugtraq/2012-10/0096.html"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5106.php"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://www.htbridge.com/advisory/HTB23113"},{"name":"subrioncms-addadmin-csrf(78469)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/78469"},{"name":"subrioncms-add-csrf(79469)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/79469"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.org/files/117460/Subrion-CMS-2.2.1-XSS-CSRF-SQL-Injection.html"},{"name":"85999","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/85999"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.subrion.com/forums/announcements/934-subrion-2-2-3-open-source-cms-core-available.html"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.org/files/116433"},{"name":"51013","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/51013"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2012-09-11T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site request forgery (CSRF) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to hijack the authentication of administrators for requests that add, delete, or modify sensitive information, as demonstrated by adding an administrator account via an add action to admin/accounts/add/."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"20121017 Multiple vulnerabilities in Subrion CMS","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://archives.neohapsis.com/archives/bugtraq/2012-10/0096.html"},{"tags":["x_refsource_MISC"],"url":"http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5106.php"},{"tags":["x_refsource_MISC"],"url":"https://www.htbridge.com/advisory/HTB23113"},{"name":"subrioncms-addadmin-csrf(78469)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/78469"},{"name":"subrioncms-add-csrf(79469)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/79469"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.org/files/117460/Subrion-CMS-2.2.1-XSS-CSRF-SQL-Injection.html"},{"name":"85999","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/85999"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.subrion.com/forums/announcements/934-subrion-2-2-3-open-source-cms-core-available.html"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.org/files/116433"},{"name":"51013","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/51013"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2012-4773","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site request forgery (CSRF) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to hijack the authentication of administrators for requests that add, delete, or modify sensitive information, as demonstrated by adding an administrator account via an add action to admin/accounts/add/."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20121017 Multiple vulnerabilities in Subrion CMS","refsource":"BUGTRAQ","url":"http://archives.neohapsis.com/archives/bugtraq/2012-10/0096.html"},{"name":"http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5106.php","refsource":"MISC","url":"http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5106.php"},{"name":"https://www.htbridge.com/advisory/HTB23113","refsource":"MISC","url":"https://www.htbridge.com/advisory/HTB23113"},{"name":"subrioncms-addadmin-csrf(78469)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/78469"},{"name":"subrioncms-add-csrf(79469)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/79469"},{"name":"http://packetstormsecurity.org/files/117460/Subrion-CMS-2.2.1-XSS-CSRF-SQL-Injection.html","refsource":"MISC","url":"http://packetstormsecurity.org/files/117460/Subrion-CMS-2.2.1-XSS-CSRF-SQL-Injection.html"},{"name":"85999","refsource":"OSVDB","url":"http://www.osvdb.org/85999"},{"name":"http://www.subrion.com/forums/announcements/934-subrion-2-2-3-open-source-cms-core-available.html","refsource":"CONFIRM","url":"http://www.subrion.com/forums/announcements/934-subrion-2-2-3-open-source-cms-core-available.html"},{"name":"http://packetstormsecurity.org/files/116433","refsource":"MISC","url":"http://packetstormsecurity.org/files/116433"},{"name":"51013","refsource":"SECUNIA","url":"http://secunia.com/advisories/51013"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2012-4773","datePublished":"2012-10-22T23:00:00.000Z","dateReserved":"2012-09-06T00:00:00.000Z","dateUpdated":"2024-08-06T20:42:55.121Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2012-10-22 23:55:08","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-352","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:intelliants:subrion_cms:*:*:*:*:*:*:*:*","versionEndIncluding":"2.2.2","matchCriteriaId":"0C3EAE3A-B0C0-4082-9E40-FDAAE4F3F89F"},{"vulnerable":true,"criteria":"cpe:2.3:a:intelliants:subrion_cms:2.0.4:*:*:*:*:*:*:*","matchCriteriaId":"29445B59-EA5D-457D-A8B0-DD16F1318F4D"},{"vulnerable":true,"criteria":"cpe:2.3:a:intelliants:subrion_cms:2.2.0:*:*:*:*:*:*:*","matchCriteriaId":"557E5750-C89C-47DC-812A-F425572CC916"},{"vulnerable":true,"criteria":"cpe:2.3:a:intelliants:subrion_cms:2.2.1:*:*:*:*:*:*:*","matchCriteriaId":"6A0B20B3-1C5F-4819-9F18-0767F40AF346"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2012","CveId":"4773","Ordinal":"1","Title":"CVE-2012-4773","CVE":"CVE-2012-4773","Year":"2012"},"notes":[{"CveYear":"2012","CveId":"4773","Ordinal":"1","NoteData":"Multiple cross-site request forgery (CSRF) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to hijack the authentication of administrators for requests that add, delete, or modify sensitive information, as demonstrated by adding an administrator account via an add action to admin/accounts/add/.","Type":"Description","Title":"CVE-2012-4773"},{"CveYear":"2012","CveId":"4773","Ordinal":"2","NoteData":"2012-10-22","Type":"Other","Title":"Published"},{"CveYear":"2012","CveId":"4773","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}