Multiple cross-site scripting (XSS) vulnerabilities in Cumin before r5238 allow remote…
Priority LOW 25CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Partial Red Hat: 4 fixed, 1 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-79.
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Cumin before r5238 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) widgets or (2) pages.
Why it matters now
EPSS 0.0235 83rd percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 4 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:trevor_mckay:cumin:*:*:*:*:*:*:*:* | up to r5237 | Vulnerable | Trevor Mckay |
- cpe:2.3:a:trevor_mckay:cumin:*:*:*:*:*:*:*:* Versions up to r5237 Vulnerable ·Trevor Mckay
Remediation
Red Hat 2 advisories
- RHSA-2012:0477 Released 2012-04-12 · Red Hat rating ModerateRed Hat Enterprise MRG Management Console security update
- Red Hat MRG Grid for RHEL 6 Server v.2 cumin-0.1.5192-5.el6
- Red Hat MRG Management for RHEL 6 Server v.2 cumin-0.1.5192-5.el6
- RHSA-2012:0476 Released 2012-04-12 · Red Hat rating ModerateRed Hat Enterprise MRG Management Console security update
- MRG Grid for RHEL 5 Server v.2 cumin-0.1.5192-4.el5
- MRG Management for RHEL 5 Server v.2 cumin-0.1.5192-4.el5
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise MRG 1 | Affected | No fix planned: Will not fix |
| MRG Grid for RHEL 5 Server v.2 | Fixed | RHSA-2012:0476 |
| MRG Management for RHEL 5 Server v.2 | Fixed | RHSA-2012:0476 |
| Red Hat MRG Grid for RHEL 6 Server v.2 | Fixed | RHSA-2012:0477 |
| Red Hat MRG Management for RHEL 6 Server v.2 | Fixed | RHSA-2012:0477 |
Timeline
- 2026-10-02 Threatist record created from CVE-2012-1575
- 2026-10-03 Alias added: GHSA-v47v-hq34-79pq
References
Advisory 2
More Trevor Mckay Cumin vulnerabilities
- TI-2012-02321 Multiple SQL injection vulnerabilities in the get_sample_filters_by_signature function in… CVSS 2.0HIGH 7.5
- TI-2012-02365 Multiple cross-site request forgery (CSRF) vulnerabilities in Cumin before 0.1.5444, as… CVSS 2.0MEDIUM 6.8
- TI-2012-02318 Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG)… CVSS 2.0MEDIUM 5.8
- TI-2012-02317 Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG)… CVSS 2.0MEDIUM 5.0
- TI-2012-02987 Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG)… CVSS 2.0MEDIUM 4.9
- TI-2012-02366 Session fixation vulnerability in Cumin before 0.1.5444, as used in Red Hat Enterprise… CVSS 2.0MEDIUM 4.9
Sources
- CVE-2012-1575 · CVE Program
- CVE-2012-1575 · NVD
- FIRST EPSS
- GHSA-v47v-hq34-79pq · GitHub Advisory Database · CC BY 4.0
- CVE-2012-1575 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences