CVEvulnerability
CVE-2011-0535
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2011-02-08
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change account privileges via an edit access_permissions action to index.php.
Affected configurations
• zikula zikula application framework (<= 1.2.4)
• zikula zikula application framework 1.1.2
• zikula zikula application framework 1.2.1
• zikula zikula application framework 1.2.2
• zikula zikula application framework 1.2.3
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://bl0g.yehg.net/2011/02/zikula-cms-124-cross-site-request.html Exploit
- http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOG code.zikula.org
- http://community.zikula.org/index.php?module=News&func=display&sid=3041&title=zikula-1.2.5-released community.zikula.org
- http://openwall.com/lists/oss-security/2011/02/01/1 Exploit
- http://openwall.com/lists/oss-security/2011/02/03/1 Exploit
- http://seclists.org/fulldisclosure/2011/Feb/0 Exploit
- http://secunia.com/advisories/43114 Vendor Advisory
- http://securityreason.com/securityalert/8067 securityreason.com
- http://www.osvdb.org/70751 www.osvdb.org
- http://bl0g.yehg.net/2011/02/zikula-cms-124-cross-site-request.html Exploit
- http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOG code.zikula.org
- http://community.zikula.org/index.php?module=News&func=display&sid=3041&title=zikula-1.2.5-released community.zikula.org
- http://openwall.com/lists/oss-security/2011/02/01/1 Exploit
- http://openwall.com/lists/oss-security/2011/02/03/1 Exploit
- http://seclists.org/fulldisclosure/2011/Feb/0 Exploit
- http://secunia.com/advisories/43114 Vendor Advisory
- http://securityreason.com/securityalert/8067 securityreason.com
- http://www.osvdb.org/70751 www.osvdb.org