LiveActive security incident?Get immediate response
CVE Record

CVE-2012-10003: ahmyi RivetTracker cross site scripting

A vulnerability, which was classified as problematic, has been found in ahmyi RivetTracker. This issue affects some unknown processing. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be initiated remotely. The patch is named f053c5cc2bc44269b0496b5f275e349928a92ef9. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217271.

MediumCVSS 4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2012-10003 is a cross-site scripting issue in ahmyi RivetTracker. A remote authenticated user may influence page output through PHP_SELF handling, affecting integrity but not confidentiality or availability per the supplied CVSS vector. Business urgency is moderate for exposed or actively used RivetTracker deployments, especially where users trust tracker pages.

Executive priority

Treat this as a moderate-priority web application hygiene issue. It is not described as data theft or system takeover, but unpatched XSS can undermine trust, sessions, and user actions in affected RivetTracker deployments.

Technical view

The source bundle maps this to CWE-79 in ahmyi RivetTracker, caused by manipulation of $_SERVER['PHP_SELF']. CVSS v2 is 4.0 with network access, low complexity, single authentication, partial integrity impact, and no confidentiality or availability impact. A patch is identified as GitHub commit f053c5cc2bc44269b0496b5f275e349928a92ef9.

Likely exposure

Exposure appears limited to organizations running ahmyi RivetTracker. The affected versions and exact processing path are not specified in the supplied sources, so teams need local inventory confirmation rather than broad product assumptions.

Exploitation context

The bundle says the attack may be initiated remotely and requires authentication per CVSS Au:S. There is no KEV listing and no supplied source evidence of active exploitation, so active exploitation should not be assumed.

Researcher notes

Evidence is sparse: affected versions are listed as unknown or n/a, and the vulnerable processing is not named. The strongest remediation evidence is the linked GitHub patch. Avoid expanding scope beyond ahmyi RivetTracker without additional vendor or code evidence.

Mitigation direction

  • Apply the referenced RivetTracker patch commit f053c5cc2bc44269b0496b5f275e349928a92ef9.
  • Confirm deployed RivetTracker code includes the PHP_SELF handling fix.
  • Restrict RivetTracker access to trusted users if patching is delayed.
  • Review vendor or project guidance for any later fixes or replacement releases.
  • Monitor tracker logs for suspicious authenticated activity around affected pages.

Validation and detection

  • Inventory whether ahmyi RivetTracker is deployed in any environment.
  • Check the deployed codebase for commit f053c5cc2bc44269b0496b5f275e349928a92ef9 or equivalent changes.
  • Confirm public or internet-facing RivetTracker instances require authentication.
  • Review application pages for unsafe reflection of server path values.
  • Document affected version uncertainty in the vulnerability record.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2012-10003 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4 (2.0)
Known Exploited
No
Published

Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4CVSS 2.0MediumAV:N/AC:L/Au:S/C:N/I:P/A:N82.9Primary CVE score

Vulnerability scoring details

Base CVSS 2.0 score

4Medium
CVSS 2.0 vector shape for CVE-2012-10003Access VectorAccess ComplexityAuthenticationConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N

Access Vector
NetworkAdjacentLocal
Access Complexity
LowMediumHigh
Authentication
NoneSingleMultiple
Confidentiality Impact
CompletePartialNone
Integrity Impact
CompletePartialNone
Availability Impact
CompletePartialNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
ahmyiRivetTrackern/aListed
Weakness

CWE details

CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.