« Volver al listado

CVE-2012-2760

Estado: ModificadaBaja (2.1)—

mod_auth_openid before 0.7 for Apache uses world-readable permissions for /tmp/mod_auth_openid.db, which allows local users to obtain session ids.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Findingscience — MOD Auth Openid

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-2760",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-07-25T19:55:05.477",
  "references": [
    {
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2012-05/0235.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.org/files/112991/Mod_Auth_OpenID-Session-Stealing.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/49247",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.exploit-db.com/exploits/18917",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:114",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/82139",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/53661",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75813",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/bmuller/mod_auth_openid/blob/master/ChangeLog",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/bmuller/mod_auth_openid/pull/30",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2012-05/0235.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://packetstormsecurity.org/files/112991/Mod_Auth_OpenID-Session-Stealing.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/49247",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/18917",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:114",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/82139",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/53661",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75813",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/bmuller/mod_auth_openid/blob/master/ChangeLog",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/bmuller/mod_auth_openid/pull/30",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "mod_auth_openid before 0.7 for Apache uses world-readable permissions for /tmp/mod_auth_openid.db, which allows local users to obtain session ids."
    },
    {
      "lang": "es",
      "value": "mod_auth_openid antes de v0.7 para Apache utiliza permisos de lectura globales en /tmp/mod_auth_openid.db, lo que permite a los usuarios locales obtener los identificadores de sesión."
    }
  ],
  "lastModified": "2026-06-16T23:42:02.713",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:findingscience:mod_auth_openid:*:*:*:*:*:apache:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1685A1F9-5CFD-4324-85EB-EED26767E3EB",
              "versionEndIncluding": "0.6"
            },
            {
              "criteria": "cpe:2.3:a:findingscience:mod_auth_openid:0.1:*:*:*:*:apache:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1DFE444-2072-4CBD-ADD3-62B31F3C5ACF"
            },
            {
              "criteria": "cpe:2.3:a:findingscience:mod_auth_openid:0.2:*:*:*:*:apache:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BA74586-05D4-4E8D-AD57-249F4A76B3EC"
            },
            {
              "criteria": "cpe:2.3:a:findingscience:mod_auth_openid:0.2.1:*:*:*:*:apache:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B8386D4-FE06-425F-833B-F014FF97AF18"
            },
            {
              "criteria": "cpe:2.3:a:findingscience:mod_auth_openid:0.3:*:*:*:*:apache:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78957F4D-07E7-4600-9F81-761774DFC3B9"
            },
            {
              "criteria": "cpe:2.3:a:findingscience:mod_auth_openid:0.4:*:*:*:*:apache:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79CE4540-AC19-433B-A19E-3D6FFC1DEB0B"
            },
            {
              "criteria": "cpe:2.3:a:findingscience:mod_auth_openid:0.5:*:*:*:*:apache:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8CF03C53-D086-4651-8B69-93CA15B73DD5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}