Cross-site request forgery (CSRF) vulnerability in controlcenter.php in FlatnuX CMS 2011…
Priority LOW 32CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Tampering
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-352.
Summary
Cross-site request forgery (CSRF) vulnerability in controlcenter.php in FlatnuX CMS 2011 08.09.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that add user accounts.
Why it matters now
EPSS 0.01183 67th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:flatnux:flatnux:*:*:*:*:*:*:*:* | up to 2011-08-09-2 | Vulnerable | Flatnux |
| cpe:2.3:a:flatnux:flatnux:2008-12-11:*:*:*:*:*:*:* | 2008-12-11 | Vulnerable | Flatnux |
| cpe:2.3:a:flatnux:flatnux:2009-01-27:*:*:*:*:*:*:* | 2009-01-27 | Vulnerable | Flatnux |
| cpe:2.3:a:flatnux:flatnux:2009-02-04:*:*:*:*:*:*:* | 2009-02-04 | Vulnerable | Flatnux |
- cpe:2.3:a:flatnux:flatnux:*:*:*:*:*:*:*:* Versions up to 2011-08-09-2 Vulnerable ·Flatnux
- cpe:2.3:a:flatnux:flatnux:2008-12-11:*:*:*:*:*:*:* Versions 2008-12-11 Vulnerable ·Flatnux
- cpe:2.3:a:flatnux:flatnux:2009-01-27:*:*:*:*:*:*:* Versions 2009-01-27 Vulnerable ·Flatnux
- cpe:2.3:a:flatnux:flatnux:2009-02-04:*:*:*:*:*:*:* Versions 2009-02-04 Vulnerable ·Flatnux
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2012-4877
- 2026-10-03 Alias added: GHSA-r464-5gc2-5fcc
References
More Flatnux vulnerabilities
- TI-2012-04122 Absolute path traversal vulnerability in controlcenter.php in FlatnuX CMS 2011 08.09.2… CVSS 2.0MEDIUM 5.0
- TI-2009-00549 PHP remote file inclusion vulnerability in include/flatnux.php in FlatnuX CMS (aka… CVSS 2.0MEDIUM 5.1
- TI-2008-05467 Multiple cross-site scripting (XSS) vulnerabilities in FlatnuX CMS (aka Flatnuke3)… CVSS 2.0MEDIUM 4.3
- TI-2012-04132 Multiple cross-site scripting (XSS) vulnerabilities in FlatnuX CMS 2011 08.09.2 and… CVSS 2.0MEDIUM 4.3
- TI-2012-04134 Multiple cross-site scripting (XSS) vulnerabilities in FlatnuX CMS 2012-03.08 and earlier… CVSS 2.0MEDIUM 4.3
- TI-2008-05465 Cross-site scripting (XSS) vulnerability in FlatnuX CMS (aka Flatnuke3) 2008-12-11 allows… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2012-4877 · CVE Program
- CVE-2012-4877 · NVD
- FIRST EPSS
- GHSA-r464-5gc2-5fcc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences