VulnerabilityModified
CVE-2011-0535
Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change account privileges via an edit access_permissions action to…
MEDIUM 6.8EPSS 1.43%
Does this matter?
Lower severity and a low EPSS score (1.43%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change account privileges via an edit access_permissions action to index.php.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 1.43% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- zikula/zikula application framework
- Source
- secalert@redhat.com
References
- http://bl0g.yehg.net/2011/02/zikula-cms-124-cross-site-request.htmlExploit
- http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOG
- http://community.zikula.org/index.php?module=News&func=display&sid=3041&title=zikula-1.2.5-released
- http://openwall.com/lists/oss-security/2011/02/01/1Exploit
- http://openwall.com/lists/oss-security/2011/02/03/1Exploit
- http://seclists.org/fulldisclosure/2011/Feb/0Exploit
- http://secunia.com/advisories/43114Vendor Advisory
- http://securityreason.com/securityalert/8067
- http://www.osvdb.org/70751
- http://bl0g.yehg.net/2011/02/zikula-cms-124-cross-site-request.htmlExploit
- http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOG
- http://community.zikula.org/index.php?module=News&func=display&sid=3041&title=zikula-1.2.5-released
- http://openwall.com/lists/oss-security/2011/02/01/1Exploit
- http://openwall.com/lists/oss-security/2011/02/03/1Exploit
- http://seclists.org/fulldisclosure/2011/Feb/0Exploit
- http://secunia.com/advisories/43114Vendor Advisory
- http://securityreason.com/securityalert/8067
- http://www.osvdb.org/70751
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.