Read the docs
TI-2012-03442 Aliases CVE-2012-4022GHSA-5prv-rg9r-4whf

Pebble before 2.6.4 allows remote attackers to trigger loss of blog-entry viewability via a crafted comment.

Priority LOW 32CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

Pebble before 2.6.4 allows remote attackers to trigger loss of blog-entry viewability via a crafted comment.

Why it matters now

EPSS 0.01511 74th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 48

CPEVersionsRoleVendor
cpe:2.3:a:simon_brown:pebble:*:*:*:*:*:*:*:*up to 2.6.3VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.0:*:*:*:*:*:*:*1.0VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.1:*:*:*:*:*:*:*1.1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.2:*:*:*:*:*:*:*1.2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.3:*:*:*:*:*:*:*1.3VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.4:*:*:*:*:*:*:*1.4VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.4:beta1:*:*:*:*:*:*1.4 beta1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.4:beta2:*:*:*:*:*:*1.4 beta2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.4:beta3:*:*:*:*:*:*1.4 beta3VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.4.1:*:*:*:*:*:*:*1.4.1VulnerableSimon Brown
  • cpe:2.3:a:simon_brown:pebble:*:*:*:*:*:*:*:* Versions up to 2.6.3 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.4:*:*:*:*:*:*:* Versions 1.4 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.4:beta1:*:*:*:*:*:* Versions 1.4 beta1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.4:beta2:*:*:*:*:*:* Versions 1.4 beta2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.4:beta3:*:*:*:*:*:* Versions 1.4 beta3 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.4.1:*:*:*:*:*:*:* Versions 1.4.1 Vulnerable ·Simon Brown
Show 38 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:simon_brown:pebble:1.4.2:*:*:*:*:*:*:*1.4.2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.5:*:*:*:*:*:*:*1.5VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.5:beta1:*:*:*:*:*:*1.5 beta1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.5:beta2:*:*:*:*:*:*1.5 beta2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.5.1:*:*:*:*:*:*:*1.5.1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.6:beta3:*:*:*:*:*:*1.6 beta3VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.7:*:*:*:*:*:*:*1.7VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.7:beta1:*:*:*:*:*:*1.7 beta1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.7.1:*:*:*:*:*:*:*1.7.1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.7.2:*:*:*:*:*:*:*1.7.2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.8:*:*:*:*:*:*:*1.8VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.9:*:*:*:*:*:*:*1.9VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.0:*:*:*:*:*:*:*2.0VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.0.0:m1:*:*:*:*:*:*2.0.0 m1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.0.0:m2:*:*:*:*:*:*2.0.0 m2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.0.0:m3:*:*:*:*:*:*2.0.0 m3VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.0.0:rc1:*:*:*:*:*:*2.0.0 rc1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.0.0:rc2:*:*:*:*:*:*2.0.0 rc2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.1:*:*:*:*:*:*:*2.1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.1:rc1:*:*:*:*:*:*2.1 rc1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.2:*:*:*:*:*:*:*2.2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.3:*:*:*:*:*:*:*2.3VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.3.1:*:*:*:*:*:*:*2.3.1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.3.2:*:*:*:*:*:*:*2.3.2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.4:*:*:*:*:*:*:*2.4VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.4:rc2:*:*:*:*:*:*2.4 rc2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.5:*:*:*:*:*:*:*2.5VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.5:m1:*:*:*:*:*:*2.5 m1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.5:m2:*:*:*:*:*:*2.5 m2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.5:rc1:*:*:*:*:*:*2.5 rc1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.5.1:*:*:*:*:*:*:*2.5.1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.5.2:*:*:*:*:*:*:*2.5.2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.5.3:*:*:*:*:*:*:*2.5.3VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.6:*:*:*:*:*:*:*2.6VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.6:m1:*:*:*:*:*:*2.6 m1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.6.1:*:*:*:*:*:*:*2.6.1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.6.2:*:*:*:*:*:*:*2.6.2VulnerableSimon Brown
  • cpe:2.3:a:simon_brown:pebble:1.4.2:*:*:*:*:*:*:* Versions 1.4.2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.5:beta1:*:*:*:*:*:* Versions 1.5 beta1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.5:beta2:*:*:*:*:*:* Versions 1.5 beta2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.6:beta3:*:*:*:*:*:* Versions 1.6 beta3 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.7:*:*:*:*:*:*:* Versions 1.7 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.7:beta1:*:*:*:*:*:* Versions 1.7 beta1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.7.1:*:*:*:*:*:*:* Versions 1.7.1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.7.2:*:*:*:*:*:*:* Versions 1.7.2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.8:*:*:*:*:*:*:* Versions 1.8 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.9:*:*:*:*:*:*:* Versions 1.9 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.0.0:m1:*:*:*:*:*:* Versions 2.0.0 m1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.0.0:m2:*:*:*:*:*:* Versions 2.0.0 m2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.0.0:m3:*:*:*:*:*:* Versions 2.0.0 m3 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.0.0:rc1:*:*:*:*:*:* Versions 2.0.0 rc1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.0.0:rc2:*:*:*:*:*:* Versions 2.0.0 rc2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.1:rc1:*:*:*:*:*:* Versions 2.1 rc1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.3:*:*:*:*:*:*:* Versions 2.3 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.3.2:*:*:*:*:*:*:* Versions 2.3.2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.4:*:*:*:*:*:*:* Versions 2.4 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.4:rc2:*:*:*:*:*:* Versions 2.4 rc2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.5:m1:*:*:*:*:*:* Versions 2.5 m1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.5:m2:*:*:*:*:*:* Versions 2.5 m2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.5:rc1:*:*:*:*:*:* Versions 2.5 rc1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.5.1:*:*:*:*:*:*:* Versions 2.5.1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.5.2:*:*:*:*:*:*:* Versions 2.5.2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.5.3:*:*:*:*:*:*:* Versions 2.5.3 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.6:*:*:*:*:*:*:* Versions 2.6 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.6:m1:*:*:*:*:*:* Versions 2.6 m1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Simon Brown

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-4022
  2. 2026-10-03 Alias added: GHSA-5prv-rg9r-4whf

References

Advisory 2

  • TI-2012-04359 Open redirect vulnerability in Pebble before 2.6.4 allows remote attackers to redirect… CVSS 2.0MEDIUM 5.8
  • TI-2012-03443 CRLF injection vulnerability in Pebble before 2.6.4 allows remote attackers to inject… CVSS 2.0MEDIUM 4.3
  • TI-2009-00701 Cross-site scripting (XSS) vulnerability in Pebble before 2.3.2 allows remote attackers… CVSS 2.0MEDIUM 4.3
  • TI-2006-04984 Cross-site scripting (XSS) vulnerability in the search functionality in Simon Brown… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences