Threats tagged 'ghsa-xw5v-gjqf-qvpm'

Apache Roller versions 5.0.1 through 6.1.6 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw that allows an unauthenticated attacker to create an administrator account. This occurs because the application only enforced request-token checks on POST requests, while administrative actions also accepted GET requests. The vulnerability is addressed in Apache Roller 6.1.7 and later, which require POST requests with a valid token for data-changing actions.