Threats tagged 'ghsa-hcxm-g8rr-hmvw'

REDAXO core versions prior to 5.21.5 have a missing authorization vulnerability in the rex_api_package API function. This flaw allows non-admin backend users who possess a valid CSRF token to manage packages, including uninstalling system addons, deactivating, installing, activating, or deleting packages. Attackers with such tokens, for example demoted admins with active sessions, can cause significant disruption such as dropping database tables of system addons.