CVE-2024-46911 Apache Roller: Weakness in CSRF protection allows privilege escalation

What is CVE-2024-46911?

CVE-2024-46911 is a medium-severity vulnerability in Apache Roller, published on 14 Oct 2024.

Official description

Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trusted to publish arbitrary weblog content and this combined with a deficiency in Roller's CSRF protections allowed an escalation of privileges attack. This issue affects Apache Roller before 6.1.4.

Roller users who run multi-blog/user Roller websites are recommended to upgrade to version 6.1.4, which fixes the issue.

Roller 6.1.4 release announcement:  https://lists.apache.org/thread/3c3f6rwqptyw6wdc95654fq5vlosqdpw

Weakness: CWE-352

Which versions are affected by CVE-2024-46911?

It affects 1 product.

Products include Apache Roller.

How do I fix CVE-2024-46911?

No fix has been published for CVE-2024-46911 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-46911 being exploited?

There is no known exploitation of CVE-2024-46911 in the wild and no public exploit code.

Other vulnerabilities in Apache Roller

• CVE-2018-17198 Server-side request forgery in Apache Roller Critical 9.8
• CVE-2014-0030 XML external entity in n/a Critical 9.8
• CVE-2021-33580 regex injection leading to DoS High 7.5
• CVE-2015-0249 Code injection in n/a High 7.2
• CVE-2013-4212 Code injection in n/a Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m3gr-45jc-g2rp.