CVE-2024-46911: Apache Roller: Weakness in CSRF protection allows privilege escalation
Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trusted to publish arbitrary weblog content and this combined with a deficiency in Roller's CSRF protections allowed an escalation of privileges attack. This issue affects Apache Roller before 6.1.4.
Roller users who run multi-blog/user Roller websites are recommended to upgrade to version 6.1.4, which fixes the issue.
Roller 6.1.4 release announcement: https://lists.apache.org/thread/3c3f6rwqptyw6wdc95654fq5vlosqdpw
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46911?
CVE-2024-46911 is considered a high severity vulnerability due to its potential for privilege escalation and cross-site resource forgery.
How do I fix CVE-2024-46911?
To fix CVE-2024-46911, it is recommended to upgrade Apache Roller to version 6.1.5 or later, where the CSRF protections have been improved.
Who is affected by CVE-2024-46911?
CVE-2024-46911 affects users of Apache Roller versions prior to 6.1.5, particularly those running multi-blog/user setups.
What type of vulnerability is CVE-2024-46911?
CVE-2024-46911 is a cross-site resource forgery (CSRF) vulnerability that can lead to privilege escalation in Apache Roller.
What causes CVE-2024-46911?
CVE-2024-46911 is caused by insufficient CSRF protections in Apache Roller, allowing unauthorized actions by privileged users.