{"id":"CVE-2012-4853","aliases":["EUVD-2012-4778","GHSA-c22m-4fxx-w8gx"],"status":"published","title":"Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Application Server 6.1 before 6...","description":"Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Application Server 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger information disclosure.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01006,"percentile":0.63247,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2012-11-14T11:00:00Z","modified":"2026-06-16T23:45:47Z","products":[{"vendor":"ibm","product":"websphere_application_server"}],"references":[{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1PM62920","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/79598","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.securityfocus.com/bid/56458","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.ibm.com/support/docview.wss?uid=swg21614265","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4853"},{"url":"https://github.com/advisories/GHSA-c22m-4fxx-w8gx"}],"sources":{"cve":[{"id":"CVE-2012-4853","description":"Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Application Server 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger information disclosure.","status":"published","published":"2012-11-14T11:00:00Z","modified":"2024-08-06T20:50:18.022Z","updated_at":"2026-11-02T14:34:51.584538Z"}],"euvd":[{"id":"EUVD-2012-4778","description":"Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Application Server 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger information disclosure.","status":"published","published":"2012-11-14T11:00:00Z","modified":"2024-08-06T20:50:18Z","updated_at":"2026-11-03T01:56:06.406129Z"}],"ghsa":[{"id":"GHSA-c22m-4fxx-w8gx","title":"Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Application Server 6.1 before 6...","description":"Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Application Server 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger information disclosure.","status":"published","published":"2022-05-17T01:41:06Z","modified":"2023-02-03T05:05:10Z","cwes":["CWE-352"],"updated_at":"2026-11-02T14:53:41.929217Z"}],"nvd":[{"id":"CVE-2012-4853","description":"Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Application Server 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger information disclosure.","status":"published","published":"2012-11-14T12:30:59.477Z","modified":"2026-06-16T23:45:47.5Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:02:16.536025Z"}]}}