VYPR
← All advisories
Medium severity4.7NVD Advisory· Published Oct 14, 2024· Updated Jun 17, 2026

CVE-2024-46911

CVE-2024-46911

Description

Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trusted to publish arbitrary weblog content and this combined with a deficiency in Roller's CSRF protections allowed an escalation of privileges attack. This issue affects Apache Roller before 6.1.4.

Roller users who run multi-blog/user Roller websites are recommended to upgrade to version 6.1.4, which fixes the issue.

Roller 6.1.4 release announcement:  https://lists.apache.org/thread/3c3f6rwqptyw6wdc95654fq5vlosqdpw

Affected products

3
  • Apache/Roller2 versions
    cpe:2.3:a:apache:roller:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:roller:*:*:*:*:*:*:*:*range: >=1.0,<6.1.4
    • (no CPE)range: <6.1.4
  • Apache Software Foundation/Apache Rollerv5
    Range: 1.0.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.