SB2026100652 - Multiple vulnerabilities in REDAXO

Description

This security bulletin contains information about 4 vulnerabilities.

1) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to delete application data and cause a denial of service.

The vulnerability exists due to missing authorization in the rex_api_package API function when handling package-management API requests with a valid CSRF token. A remote user can manage locally available packages to delete application data and cause a denial of service.

Exploitation requires a valid CSRF token for this API function; such tokens are normally generated only on administrator-restricted pages. Installations operating in live mode are not affected.

2) Insufficient Session Expiration (CVE-ID: N/A)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to maintain unauthorized access to an account.

The vulnerability exists due to insufficient session expiration in the current backend session and stay-logged-in key when a backend user changes their password. A remote user can use a previously obtained session ID or stay-logged-in cookie to maintain unauthorized access to an account.

The stay-logged-in key can remain valid for up to three months.

3) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to modify safe mode settings.

The vulnerability exists due to missing cross-site request forgery protection in the safe mode toggle when processing the safemode request parameter. A remote attacker can trick a logged-in administrator into opening a crafted link to modify safe mode settings.

The installation must not be in live mode.

4) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to missing authorization in the backup add-on database export feature when selecting database tables for export. A remote user can export authentication tables containing active session identifiers or stay-logged-in keys to take over administrator accounts.

Exploitation requires that an administrator has granted the non-administrative user the backup[export] permission.

Remediation

Install update from vendor's website.

References

• https://github.com/redaxo/core/security/advisories/GHSA-fw98-549m-whxx
• https://github.com/redaxo/core/security/advisories/GHSA-mjjv-vffq-g5h6
• https://github.com/redaxo/core/security/advisories/GHSA-423v-8x3h-gxr3
• https://github.com/redaxo/core/security/advisories/GHSA-phjc-vx3j-58r3