certfr_avis - certa-2012-avi-036

CERTA-2012-AVI-036

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités permettant entre autres l'exécution de code arbitraire à distance ont été corrigées dans Postfix Admin.

Description

De multiples vulnérabilités de type injection SQL et XSS ont été corrigées dans Postfix Admin. Elles permettent entre autres l'exécution de code arbitraire à distance et l'injection de code indirecte à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Postfix Admin versions antérieures à 2.3.5.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Note de version Postfix Admin 2.3.5 du 16 janvier 2012

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cp\u003ePostfix Admin versions ant\u00e9rieures \u00e0  2.3.5.\u003c/p\u003e",
  "content": "## Description\n\nDe multiples vuln\u00e9rabilit\u00e9s de type injection SQL et XSS ont \u00e9t\u00e9\ncorrig\u00e9es dans Postfix Admin. Elles permettent entre autres l\u0027ex\u00e9cution\nde code arbitraire \u00e0 distance et l\u0027injection de code indirecte \u00e0\ndistance.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2012-0811",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-0811"
    },
    {
      "name": "CVE-2012-0812",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-0812"
    }
  ],
  "links": [],
  "reference": "CERTA-2012-AVI-036",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-01-31T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s permettant entre autres l\u0027ex\u00e9cution de code\narbitraire \u00e0 distance ont \u00e9t\u00e9 corrig\u00e9es dans Postfix Admin.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Postfix Admin",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Note de version Postfix Admin 2.3.5 du 16 janvier 2012",
      "url": "http://postfixadmin.svn.sourceforge.net/svnroot/postfixadmin/branches/postfixadmin-2.3/CHANGELOG.TXT"
    }
  ]
}

CVE-2012-0812 (GCVE-0-2012-0812)

Vulnerability from cvelistv5 – Published: 2019-11-22 16:07 – Updated: 2024-08-06 18:38

Summary

PostfixAdmin 2.3.4 has multiple XSS vulnerabilities

Severity ?

No CVSS data available.

CWE

2.3.4 multiple XSS vulnerabilities

Assigner

redhat

References

URL

Tags

	https://security-tracker.debian.org/tracker/CVE-2…	x_refsource_MISC
	https://access.redhat.com/security/cve/cve-2012-0812	x_refsource_MISC
	https://bugs.gentoo.org/show_bug.cgi?id=CVE-2012-0812	x_refsource_MISC
	http://security.gentoo.org/glsa/glsa-201209-18.xml	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2012/0…	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2012/01/27/5	x_refsource_MISC
	http://www.securityfocus.com/bid/51680	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	postfixadmin	postfixadmin	Affected: 2.3.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:38:14.912Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security-tracker.debian.org/tracker/CVE-2012-0812"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/cve-2012-0812"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.gentoo.org/show_bug.cgi?id=CVE-2012-0812"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-201209-18.xml"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/01/26/12"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/01/27/5"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/51680"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "postfixadmin",
          "vendor": "postfixadmin",
          "versions": [
            {
              "status": "affected",
              "version": "2.3.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PostfixAdmin 2.3.4 has multiple XSS vulnerabilities"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "2.3.4 multiple XSS vulnerabilities",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-22T16:07:23",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security-tracker.debian.org/tracker/CVE-2012-0812"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://access.redhat.com/security/cve/cve-2012-0812"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.gentoo.org/show_bug.cgi?id=CVE-2012-0812"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-201209-18.xml"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/01/26/12"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/01/27/5"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.securityfocus.com/bid/51680"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2012-0812",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "postfixadmin",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2.3.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "postfixadmin"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PostfixAdmin 2.3.4 has multiple XSS vulnerabilities"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "2.3.4 multiple XSS vulnerabilities"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security-tracker.debian.org/tracker/CVE-2012-0812",
              "refsource": "MISC",
              "url": "https://security-tracker.debian.org/tracker/CVE-2012-0812"
            },
            {
              "name": "https://access.redhat.com/security/cve/cve-2012-0812",
              "refsource": "MISC",
              "url": "https://access.redhat.com/security/cve/cve-2012-0812"
            },
            {
              "name": "https://bugs.gentoo.org/show_bug.cgi?id=CVE-2012-0812",
              "refsource": "MISC",
              "url": "https://bugs.gentoo.org/show_bug.cgi?id=CVE-2012-0812"
            },
            {
              "name": "http://security.gentoo.org/glsa/glsa-201209-18.xml",
              "refsource": "MISC",
              "url": "http://security.gentoo.org/glsa/glsa-201209-18.xml"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2012/01/26/12",
              "refsource": "MISC",
              "url": "http://www.openwall.com/lists/oss-security/2012/01/26/12"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2012/01/27/5",
              "refsource": "MISC",
              "url": "http://www.openwall.com/lists/oss-security/2012/01/27/5"
            },
            {
              "name": "http://www.securityfocus.com/bid/51680",
              "refsource": "MISC",
              "url": "http://www.securityfocus.com/bid/51680"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-0812",
    "datePublished": "2019-11-22T16:07:23",
    "dateReserved": "2012-01-19T00:00:00",
    "dateUpdated": "2024-08-06T18:38:14.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-0811 (GCVE-0-2012-0811)

Vulnerability from cvelistv5 – Published: 2014-10-01 14:00 – Updated: 2024-08-06 18:38

Summary

Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files generated by backup.php.

Severity ?

No CVSS data available.

CWE

Assigner

redhat

References

URL

Tags

	http://www.securityfocus.com/bid/51680	vdb-entryx_refsource_BID
	http://www.openwall.com/lists/oss-security/2012/01/26/5	mailing-listx_refsource_MLIST
	http://www.codseq.it/advisories/multiple_vulnerab…	x_refsource_MISC
	https://svn.code.sf.net/p/postfixadmin/code/branc…	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2012/01/27/5	mailing-listx_refsource_MLIST

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:38:14.403Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "51680",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/51680"
          },
          {
            "name": "[oss-security] 20120126 CVE request: PostfixAdmin SQL injections and XSS",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/01/26/5"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.codseq.it/advisories/multiple_vulnerabilities_in_postfixadmin"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://svn.code.sf.net/p/postfixadmin/code/branches/postfixadmin-2.3/CHANGELOG.TXT"
          },
          {
            "name": "[oss-security] 20120127 Re: CVE request: PostfixAdmin SQL injections and XSS",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/01/27/5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-01-26T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files generated by backup.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-10-01T13:57:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "51680",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/51680"
        },
        {
          "name": "[oss-security] 20120126 CVE request: PostfixAdmin SQL injections and XSS",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/01/26/5"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.codseq.it/advisories/multiple_vulnerabilities_in_postfixadmin"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://svn.code.sf.net/p/postfixadmin/code/branches/postfixadmin-2.3/CHANGELOG.TXT"
        },
        {
          "name": "[oss-security] 20120127 Re: CVE request: PostfixAdmin SQL injections and XSS",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/01/27/5"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2012-0811",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files generated by backup.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "51680",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/51680"
            },
            {
              "name": "[oss-security] 20120126 CVE request: PostfixAdmin SQL injections and XSS",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2012/01/26/5"
            },
            {
              "name": "http://www.codseq.it/advisories/multiple_vulnerabilities_in_postfixadmin",
              "refsource": "MISC",
              "url": "http://www.codseq.it/advisories/multiple_vulnerabilities_in_postfixadmin"
            },
            {
              "name": "https://svn.code.sf.net/p/postfixadmin/code/branches/postfixadmin-2.3/CHANGELOG.TXT",
              "refsource": "CONFIRM",
              "url": "https://svn.code.sf.net/p/postfixadmin/code/branches/postfixadmin-2.3/CHANGELOG.TXT"
            },
            {
              "name": "[oss-security] 20120127 Re: CVE request: PostfixAdmin SQL injections and XSS",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2012/01/27/5"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-0811",
    "datePublished": "2014-10-01T14:00:00",
    "dateReserved": "2012-01-19T00:00:00",
    "dateUpdated": "2024-08-06T18:38:14.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTA-2012-AVI-036

Description

Solution

CVE-2012-0812 (GCVE-0-2012-0812)

CVE-2012-0811 (GCVE-0-2012-0811)

Tags

Sightings

Nomenclature