CSRF in Apache Roller

CVE-2012-2380

Multiple cross-site request forgery (CSRF) vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 allow remote attackers to hijack the authentication of admins or editors by leveraging the HTTP POST functionality.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.002 (48.4th percentile) — read the EPSS interpretation.

Affected products

  • Apache Roller — versions 0.9.5, 0.9.6, 0.9.6.3
  • N/a — versions n/a

Weakness classification (CWE)

References