low3.5
CVE-2012-4954
The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value duri…
Impact
The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value during a man-in-the-middle attack, related to a "parameter manipulation" issue.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vanillaforums | Vanilla | through 2.0.18.4 Versions 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4 |
| Vanillaforums | Vanilla Forums | through 2.1 |