Unscored CVE-2012-3472 EUVD-2012-3428GHSA-mcf8-556r-mjwr

The email API in application/libraries/api/MY_Email_Api_Object.php in the Ushahidi Platform before 2.5 does not require authentication, whi…

Published Aug 12, 2012 · Updated Sep 16, 2024 · Assigned by redhat

Description

The email API in application/libraries/api/MY_Email_Api_Object.php in the Ushahidi Platform before 2.5 does not require authentication, which allows remote attackers to list, delete, or organize messages via a GET request.

References

[oss-security] 20120809 Re: CVE request for Ushahidi mailing-list
https://github.com/ushahidi/Ushahidi_Web/commit/4c24325