Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.1

ELinks before 0.12pre6 can let remote servers act as the user

CVE-2012-4545 · published 13 years ago
Summary

The web browser ELinks versions prior to 0.12pre6 can forward your login credentials to a remote site when using certain authentication methods. This could allow the remote site to impersonate you on other services. Update to the latest version of ELinks or disable Negotiate/GSS authentication to stop the credential forwarding.

What to do
  • Update debian elinks to version 0.12~pre5-9.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian elinks < 0.12~pre5-9
Fix: upgrade to 0.12~pre5-9
Debian:13 debian elinks < 0.12~pre5-9
Fix: upgrade to 0.12~pre5-9
Debian:14 debian elinks < 0.12~pre5-9
Fix: upgrade to 0.12~pre5-9
– elinks elinks 0.12
cpe:2.3:a:elinks:elinks:0.12:pre1:*:*:*:*:*:*
Original advisory text
The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6, when using HTTP Negotiate or GSS-Negotiate authentication, delegates user credentials th...
The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6, when using HTTP Negotiate or GSS-Negotiate authentication, delegates user credentials through GSSAPI, which allows remote servers to authenticate as the client via the delegated credentials.
References
Severity
5.1 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published3 Jan 2013
Updated4 Nov 2026
First seen5 Sep 2026
Sources
DEBIAN-CVE-2012-4545 · OSV
CVE-2012-4545 · NVD
Track software like this
Free during beta