CVE-2026-117534: redaxo core, CSRF

Описание

Оригинално описание

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or rex_history_function=snap, permanently deleting all article snapshots or reverting articles to earlier states.

Засегнати продукти

• redaxo core: преди 5.21.3; 5.21.3

Вид слабост

• CWE-352 CSRF

История

Други уязвимости в redaxo core

• 4.1CVE-2026-117538
• 4.1CVE-2026-117537
• 8.8CVE-2026-117536
• 6.1CVE-2026-117535
• 4.4CVE-2026-117533

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-117534
• https://nvd.nist.gov/vuln/detail/CVE-2026-117534
• https://github.com/redaxo/core/security/advisories/GHSA-vjwx-3c33-xwmc
• https://www.vulncheck.com/advisories/redaxo-before-5.21.3-csrf-in-article-history-plugin