Description

Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change account privileges via an edit access_permissions action to index.php.

Remediation

References

CVE-2011-0535

Related Vulnerabilities

Wordpress Plugin Backup Migration Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-36884)

WordPress Plugin Toolset Types-Custom Post Types, Custom Fields and Taxonomies Privilege Escalation (2.3.3)

Drupal Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2008-6532)

WordPress Plugin Custom Body Class Cross-Site Request Forgery (0.6.0)

Oracle JRE CVE-2012-5089 Vulnerability (CVE-2012-5089)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-352 CVE-2011-0535