Not rated
CVE-2024-46911 Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller
Description
Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trusted to publish arbitrary weblog content and this combined with a deficiency in Roller's CSRF protections allowed an escalation of privileges attack. This issue affects Apache Roller before 6.1.4. Roller users who run multi-blog/user Roller websites are recommended to upgrade to version 6.1.4, which fixes the issue. Roller 6.1.4 release announcement: https://lists.apache.org/thread/3c3f6rwqptyw6wdc95654fq5vlosqdpw
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Roller 1.0 | 1.0.0 → < 6.1.4 | 6.1.4 |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Roller
The 24 CVEs of Apache Roller →
CVE-2026-86507
Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted…
6.1
Medium
CVE-2026-82379
Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest…
7.7
High
CVE-2026-82380
Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform…
8.1
High
CVE-2026-82381
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a…
5.4
Medium