Description

Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change account privileges via an edit access_permissions action to index.php.

Remediation

References

CVE-2011-0535

Related Vulnerabilities

Oracle Database Server CVE-2014-6514 Vulnerability (CVE-2014-6514)

WordPress Plugin Ultimate Member-User Profile, Registration, Login, Member Directory, Content Restriction & Membership Cross-Site Scripting (2.8.3)

Apache Traffic Server Improper Input Validation Vulnerability (CVE-2021-37148)

WordPress Plugin Meta Box-WordPress Custom Fields Framework Arbitrary File Deletion (4.16.2)

WordPress Plugin WP Whois Domain Cross-Site Scripting (1.0.0)

Severity

Medium

Classification

CVE-2011-0535 CWE-352

Tags

Missing Update Known Vulnerabilities