CVE-2016-20053: Redaxo CMS 5.2 Cross-Site Request Forgery via users endpoint
Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the users endpoint with hidden fields containing admin credentials and account parameters to add new administrator accounts without user consent.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-20053?
CVE-2016-20053 is classified as a critical Cross-Site Request Forgery vulnerability.
How do I fix CVE-2016-20053?
To fix CVE-2016-20053, upgrade Redaxo CMS to a version later than 5.2 that includes the security patches.
Who is affected by CVE-2016-20053?
CVE-2016-20053 affects all users of Redaxo CMS version 5.2.
What type of attack is possible with CVE-2016-20053?
CVE-2016-20053 allows unauthenticated attackers to create administrative user accounts through Cross-Site Request Forgery.
Is CVE-2016-20053 easy to exploit?
Yes, CVE-2016-20053 can be easily exploited by tricking authenticated administrators into visiting malicious pages.