SB2026080110 - Multiple vulnerabilities in REDAXO

Description

This security bulletin contains information about 4 vulnerabilities.

1) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause loss of recovery data.

The vulnerability exists due to cross-site request forgery in the article history plugin history administration page when handling a crafted top-level GET request with the func=clearall parameter. A remote attacker can trick a logged-in victim into opening an attacker-controlled page to cause loss of recovery data.

This action permanently deletes every stored article snapshot and requires user interaction from an administrator victim who is logged into the backend.

2) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to roll back article content without authorization.

The vulnerability exists due to cross-site request forgery in the article history plugin bootstrap when handling a crafted top-level GET request with the rex_history_function=snap parameter. A remote attacker can trick a logged-in victim into opening an attacker-controlled page to roll back article content without authorization.

The issue restores a previously stored snapshot over the current article content, and user interaction is required from a victim holding the history[article_rollback] permission.

3) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary JavaScript in the victim's browser within the backend origin.

The vulnerability exists due to cross-site scripting in the backend media pool detail page when handling the opener_link request parameter. A remote attacker can send a specially crafted link to inject arbitrary HTML and JavaScript and execute arbitrary JavaScript in the victim's browser within the backend origin.

User interaction is required, and exploitation succeeds only when a logged-in backend user with media permissions opens a crafted link, opener_input_field is absent from the request, and file_id references an existing media file.

4) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to cross-site request forgery in the backend user administration page=users/users when handling crafted GET requests that trigger the update path without a valid CSRF token. A remote attacker can trick a logged-in backend user with the users[] permission into opening an attacker-controlled page to escalate privileges.

User interaction is required, and the issue can also deactivate accounts or lock out the only administrator by modifying account status through the same update path.

Remediation

Install update from vendor's website.

References

• https://github.com/redaxo/core/security/advisories/GHSA-vjwx-3c33-xwmc
• https://github.com/redaxo/core/security/advisories/GHSA-5293-gg47-5xmh
• https://github.com/redaxo/core/security/advisories/GHSA-mrrj-4f5x-j958