← Vulnerability feed

Vulnerability record · CVE-2012-4545 · published 3 January 2013

CVE-2012-4545: Elinks improper authentication vulnerability

EElinks · Elinks

The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6, when using HTTP Negotiate or GSS-Negotiate authentication, delegates user credentials through GSSAPI, which allows remote servers to authenticate as the client via the delegated credentials.

5.1 CVSS 2.0 Medium EPSS 1.9% · top 21.0% CWE-287 · Improper authentication
5.1CVSS 2.0 base score
1.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
16References
16 Jun 2026Last modified by NVD

Description

The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6, when using HTTP Negotiate or GSS-Negotiate authentication, delegates user credentials through GSSAPI, which allows remote servers to authenticate as the client via the delegated credentials.

AV:N/AC:H/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://bugzilla.elinks.cz/show_bug.cgi?id=1124
http://repo.or.cz/w/elinks.git/blobdiff/89056e21fc7ab8e1c2d4e06ec9d0c6d01e70669a..da18694ff7dd0b67dfcb3c417fb0579b1e7d02
http://rhn.redhat.com/errata/RHSA-2013-0250.html
http://secunia.com/advisories/51569 Vendor Advisory
http://www.debian.org/security/2012/dsa-2592
http://www.mandriva.com/security/advisories?name=MDVSA-2013:075
http://www.securityfocus.com/bid/57065
https://exchange.xforce.ibmcloud.com/vulnerabilities/80882
http://bugzilla.elinks.cz/show_bug.cgi?id=1124
http://repo.or.cz/w/elinks.git/blobdiff/89056e21fc7ab8e1c2d4e06ec9d0c6d01e70669a..da18694ff7dd0b67dfcb3c417fb0579b1e7d02
http://rhn.redhat.com/errata/RHSA-2013-0250.html
http://secunia.com/advisories/51569 Vendor Advisory
http://www.debian.org/security/2012/dsa-2592
http://www.mandriva.com/security/advisories?name=MDVSA-2013:075
http://www.securityfocus.com/bid/57065
https://exchange.xforce.ibmcloud.com/vulnerabilities/80882

Track CVE-2012-4545 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2008-7224Elinks memory buffer overflow vulnerabilityBuffer overflow in entity_cache in ELinks before 0.11.4rc0 allows remote attackers to cause a denial of service (crash) via a crafted link.EPSS 2.8%7.5CVE-2006-5925Elinks vulnerabilityLinks web browser 1.00pre12 and Elinks 0.9.2 with smbclient installed allows remote attackers to execute arbitrary code via shell metacharacters in a…EPSS 8.3%5.9CVE-2012-6709Elinks improper certificate validation vulnerabilityELinks 0.12 and Twibright Links 2.3 have Missing SSL Certificate Validation.EPSS 0.57%5.0CVE-2002-1405Elinks vulnerabilityCRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP request that is provided on …EPSS 5.0%4.4CVE-2007-2027Elinks vulnerabilityUntrusted search path vulnerability in the add_filename_to_string function in intl/gettext/loadmsgcat.c for Elinks 0.11.1 allows local users to cause…EPSS 0.84%4.3CVE-2007-5034Elinks information exposure vulnerabilityELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request i…EPSS 2.6%7.5CVE-2026-42018JFrog Artifactory improper authentication leaks anonymous tokenJFrog Artifactory can return an internal anonymous-user token to an unauthenticated caller even when anonymous access is disabled. Because the token …KEVEPSS 9.8%analysed9.8CVE-2026-82329JFrog Artifactory improper authentication allows admin takeoverJFrog Artifactory contains an improper authentication weakness (CWE-287) that, under default configuration, may let an unauthenticated attacker with …KEVEPSS 14%analysed

Source: NIST National Vulnerability Database (record CVE-2012-4545), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.