CVE-2016-20053
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the users endpoint with hidden fields containing admin credentials and account parameters to add new administrator accounts without user consent.
Risk Assessment
The risk is the potential for unauthorized creation of an administrator account, which could lead to full compromise of the CMS system by the attacker.
Recommendation
Update Redaxo CMS to the latest version that includes CSRF fixes, and implement protection mechanisms such as CSRF tokens and Origin header validation.
Original NVD description (English source)
Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the users endpoint with hidden fields containing admin credentials and account parameters to add new administrator accounts without user consent.