NVD Vulnerability Detail

CVE-2011-0535

Summary	Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change account privileges via an edit access_permissions action to index.php.
Publication Date	Feb. 9, 2011, 7 a.m.
Registration Date	Jan. 28, 2021, 4:37 p.m.
Last Update	Nov. 21, 2024, 10:24 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:zikula:zikula_application_framework:1.2.3:::::::*
cpe:2.3:a:zikula:zikula_application_framework:1.1.2:::::::*
cpe:2.3:a:zikula:zikula_application_framework:1.2.2:::::::*
cpe:2.3:a:zikula:zikula_application_framework:1.2.1:::::::*
cpe:2.3:a:zikula:zikula_application_framework::::::::		1.2.4

Related information, measures and tools

No	URL	タグ
1	http://bl0g.yehg.net/2011/02/zikula-cms-124-cross-site-request.html	Exploit
2	http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOG
3	http://community.zikula.org/index.php?module=News&func=display&sid=3041&title=zikula-1.2.5-released
4	http://openwall.com/lists/oss-security/2011/02/01/1	Exploit
5	http://openwall.com/lists/oss-security/2011/02/03/1	Exploit
6	http://seclists.org/fulldisclosure/2011/Feb/0	Exploit
7	http://secunia.com/advisories/43114	Vendor Advisory
8	http://securityreason.com/securityalert/8067
9	http://www.osvdb.org/70751
10	http://bl0g.yehg.net/2011/02/zikula-cms-124-cross-site-request.html	Exploit
11	http://www.osvdb.org/70751
12	http://securityreason.com/securityalert/8067
13	http://secunia.com/advisories/43114	Vendor Advisory
14	http://seclists.org/fulldisclosure/2011/Feb/0	Exploit
15	http://openwall.com/lists/oss-security/2011/02/03/1	Exploit
16	http://openwall.com/lists/oss-security/2011/02/01/1	Exploit
17	http://community.zikula.org/index.php?module=News&func=display&sid=3041&title=zikula-1.2.5-released
18	http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOG

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-352	クロスサイト・リクエスト・フォージェリ（CSRF）	https://cwe.mitre.org/data/definitions/352.html
2	CWE-352	同一生成元ポリシー違反	https://cwe.mitre.org/data/definitions/346.html

JVN Vulnerability Information

Zikula の Users モジュールにおけるクロスサイトリクエストフォージェリの脆弱性

Title	Zikula の Users モジュールにおけるクロスサイトリクエストフォージェリの脆弱性
Summary	Zikula の Users モジュールには、クロスサイトリクエストフォージェリの脆弱性が存在します。
Possible impacts	第三者により、index.php への access_permissions アクションの編集を介して、アカウントの権限を変更する管理者要求をハイジャックされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Feb. 8, 2011, midnight
Registration Date	March 27, 2012, 6:42 p.m.
Last Update	March 27, 2012, 6:42 p.m.

Affected System

Zikula Foundation

Zikula Application Framework 1.2.5 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-0535	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0535
National Vulnerability Database (NVD)
2	CVE-2011-0535	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0535

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-352	https://jvndb.jvn.jp/ja/cwe/CWE-352.html

ベンダー情報

No	Name	URL
Zikula
1	Top Page	http://zikula.org/

Change Log

No	Changed Details	Date of change
0	[2012年03月27日] 掲載	Feb. 17, 2018, 10:37 a.m.