CVE-2016-20053
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the users endpoint with hidden fields containing admin credentials and account parameters to add new administrator accounts without user consent.
Risk Assessment
The risk is the potential for unauthorized creation of an administrator account, which could lead to full compromise of the CMS system by the attacker.
Recommendation
Update Redaxo CMS to the latest version that includes CSRF fixes, and implement protection mechanisms such as CSRF tokens and Origin header validation.
Other vulnerabilities in Redaxo CMS
See all- CVE-2025-64050High
A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload executes when visitors access frontend pages using the compromised template.
- CVE-2025-64049Medium
A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding a slice that uses the compromised module.
Original NVD description (English source)
Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the users endpoint with hidden fields containing admin credentials and account parameters to add new administrator accounts without user consent.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS