PT-2024-32280 · Apache · Apache Roller

Chi Tran · Published 2024-10-13 · Updated 2024-11-01 · CVE-2024-46911

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Apache Roller versions prior to 6.1.4

Description A Cross-site Resource Forgery (CSRF) and privilege escalation vulnerability exists in Apache Roller. On multi-blog/user Roller websites, weblog owners are trusted to publish arbitrary weblog content by default. This, combined with a deficiency in Roller's CSRF protections, allows an escalation of privileges attack.

Recommendations To resolve the issue, upgrade to version 6.1.4, which fixes the problem. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-46911

Affected Products

Apache Roller

References · 14

• https://osv.dev/vulnerability/CVE-2024-46911 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-46911 · Security Note
• https://lists.apache.org/thread/6m0ghjo9j92qty00t2qb6qf2spds0p5t · Vendor Advisory
• https://t.me/pentestingnews/52301 · Telegram Post
• https://twitter.com/ohhara_shiojiri/status/1845680276103680390 · Twitter Post
• https://twitter.com/vipr_lab/status/1846169734187827450 · Twitter Post
• https://twitter.com/pravin_karthik/status/1845841383837352068 · Twitter Post
• https://twitter.com/fridaysecurity/status/1845644346592227783 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1845643164654399621 · Twitter Post
• http://openwall.com/lists/oss-security/2024/10/12/1 · Note
• https://t.me/cvedetector/7804 · Telegram Post
• https://twitter.com/CVEnew/status/1845741727002337697 · Twitter Post
• https://twitter.com/Dinosn/status/1845661169144484066 · Twitter Post
• https://t.me/cvenotify/97980 · Telegram Post