CVE-2018-25370: Admidio 3.3.5 Cross-Site Request Forgery via roles_function.php
Admidio 3.3.5 contains a cross-site request forgery vulnerability that allows low-privilege users to increase their permissions by exploiting improper origin checking. Attackers can craft malicious HTML forms targeting rolesfunction.php with parameters like rolassignroles, rolapproveusers, and roledituser set to 1 to escalate privileges without authentication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-25370?
The severity of CVE-2018-25370 is rated as medium with a score of 5.3.
How do I fix CVE-2018-25370?
To fix CVE-2018-25370, it is recommended to upgrade to a version of Admidio that addresses the cross-site request forgery vulnerability.
What are the potential impacts of CVE-2018-25370?
CVE-2018-25370 allows low-privilege users to increase their permissions, potentially leading to unauthorized access within the application.
Which Admidio version is affected by CVE-2018-25370?
CVE-2018-25370 affects Admidio version 3.3.5.
What kind of vulnerability is CVE-2018-25370?
CVE-2018-25370 is classified as a cross-site request forgery (CSRF) vulnerability.