CVE-2011-0535

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2011-02-08 · updated 2026-06-16
Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change account privileges via an edit access_permissions action to index.php.

Affected products

Zikula Application Framework: through 1.2.4; 1.1.2, 1.2.1, 1.2.2, 1.2.3

References

http://bl0g.yehg.net/2011/02/zikula-cms-124-cross-site-request.html
http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOG
http://community.zikula.org/index.php?module=News&func=display&sid=3041&title=zikula-1.2.5-released
http://openwall.com/lists/oss-security/2011/02/01/1
http://openwall.com/lists/oss-security/2011/02/03/1
http://seclists.org/fulldisclosure/2011/Feb/0
http://secunia.com/advisories/43114
http://securityreason.com/securityalert/8067
http://www.osvdb.org/70751
http://bl0g.yehg.net/2011/02/zikula-cms-124-cross-site-request.html
http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOG
http://community.zikula.org/index.php?module=News&func=display&sid=3041&title=zikula-1.2.5-released

Get alerted when CVE-2011-0535 or the next vulnerability affects your stack