CVE-2012-0829

Severity: medium (CVSS 6.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-02-14 · updated 2026-06-16
Weakness: CWE-352

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in Mibew Messenger 1.6.4 and earlier allow remote attackers to hijack the authentication of operators for requests that insert cross-site scripting (XSS) sequences via the (1) address or (2) threadid parameters to operator/ban.php; or (3) geolinkparams, (4) title, or (5) chattitle parameters to operator/settings.php.

Affected products

Mibew Messenger: through 1.6.4; 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.4.0 (+9)

References

http://archives.neohapsis.com/archives/bugtraq/2012-01/0178.html
http://secunia.com/advisories/47787
http://www.codseq.it/advisories/mibew_messenger_multiple_xss
http://www.openwall.com/lists/oss-security/2012/02/02/10
http://www.securityfocus.com/bid/51723
https://exchange.xforce.ibmcloud.com/vulnerabilities/72822
http://archives.neohapsis.com/archives/bugtraq/2012-01/0178.html
http://secunia.com/advisories/47787
http://www.codseq.it/advisories/mibew_messenger_multiple_xss
http://www.openwall.com/lists/oss-security/2012/02/02/10
http://www.securityfocus.com/bid/51723
https://exchange.xforce.ibmcloud.com/vulnerabilities/72822

Get alerted when CVE-2012-0829 or the next vulnerability affects your stack