CVE-2011-0535

Status: ModifiedMedium (6.8)—

Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change account privileges via an edit access_permissions action to index.php.

CVSS

Version: 2.0
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Base score: 6.8

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 1.43%
Percentile among all scored CVEs: 72
Score date: 10/5/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Zikula — Zikula Application Framework

CWEs

CWE-352

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2011-0535",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2011-02-08T22:00:01.213",
  "references": [
    {
      "url": "http://bl0g.yehg.net/2011/02/zikula-cms-124-cross-site-request.html",
      "tags": [
        "Exploit"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOG",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://community.zikula.org/index.php?module=News&func=display&sid=3041&title=zikula-1.2.5-released",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2011/02/01/1",
      "tags": [
        "Exploit"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2011/02/03/1",
      "tags": [
        "Exploit"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2011/Feb/0",
      "tags": [
        "Exploit"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/43114",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://securityreason.com/securityalert/8067",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.osvdb.org/70751",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://bl0g.yehg.net/2011/02/zikula-cms-124-cross-site-request.html",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOG",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://community.zikula.org/index.php?module=News&func=display&sid=3041&title=zikula-1.2.5-released",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2011/02/01/1",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2011/02/03/1",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2011/Feb/0",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/43114",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/8067",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/70751",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change account privileges via an edit access_permissions action to index.php."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en el módulo \"Users\" (usuarios) de Zikula en versiones anteriores a la 1.2.5. Permite a atacantes remotos secuestrar (\"hijack\") la autenticación de administradores para peticiones que cambian los privilegios de cuenta a través de una acción de edición de \"access_permissions\" de index.php."
    }
  ],
  "lastModified": "2026-06-16T23:27:34.977",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zikula:zikula_application_framework:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F3EDC0F-1F8B-4F91-BC01-B0EB6C96DF94",
              "versionEndIncluding": "1.2.4"
            },
            {
              "criteria": "cpe:2.3:a:zikula:zikula_application_framework:1.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F1B6758-3E03-412F-84BD-83C8B669F738"
            },
            {
              "criteria": "cpe:2.3:a:zikula:zikula_application_framework:1.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CB69408-9D6A-475F-BB4B-E5F52465FE42"
            },
            {
              "criteria": "cpe:2.3:a:zikula:zikula_application_framework:1.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A76E5B1A-8CD3-40E6-B491-81F7D8B8F86A"
            },
            {
              "criteria": "cpe:2.3:a:zikula:zikula_application_framework:1.2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6EE3D78-D9A4-4CC3-A242-232CA58C6B68"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}