Back to Database
Status published
Medium
CVE-2012-6562
engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions...
Vulnerability Description
engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accounts.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2012-6562
Credits & Attribution
No credits recorded in the NVD database.
References
More from elgg
View All →CVE-2021-4072
Cross-site Scripting (XSS) - Stored in elgg/elgg
Critical
9
CVE-2021-3980
Exposure of Private Personal Information to an Unauthorized Actor in elgg/elgg
Medium
5.3
CVE-2021-3964
Authorization Bypass Through User-Controlled Key in elgg/elgg
Medium
4.3
CVE-2019-11016
Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open...
Medium
6.1
CVE-2013-0234
Cross-site scripting (XSS) vulnerability in the Twitter widget in Elgg...
Medium
4.3
Affected Vendor
elgg
View all reports →Affected Software
elgg
Vulnerable Versions:
0, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.7.7, 1.7.8, 1.7.9, 1.7.10, 1.7.11, 1.7.12, 1.7.13, 1.7.14, 1.7.15, 1.7.16, 1.7.17, 1.7.18, 1.8.0.1, 1.8.1, 1.8.3
Timeline
Official Publish:
May 23rd, 2013
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.