A Cross-Site Request Forgery (CSRF) vulnerability in the REDAXO core allows an unauthenticated attacker to remotely trigger unauthorized addon updates and modify system code.

The vulnerability exists within the rex_api_install_package_update function, which fails to enforce CSRF token validation. An unauthenticated attacker can execute this function by tricking an authenticated administrator into visiting a malicious link, resulting in the unauthorized installation or modification of site addons.

Successful exploitation allows an attacker to alter the integrity of the content management system by installing or updating malicious addons. This could lead to full site compromise, unauthorized data access, or significant operational disruption. While the CVSS score of 6.4 (Medium) reflects the requirement for user interaction, the potential for arbitrary code execution via addon manipulation poses a substantial risk to organizational security.

Immediate Action: Update the REDAXO core installation to version 5.21.2 or later to include the necessary CSRF protection.

Proactive Monitoring: Review web server access logs for unusual requests directed at the package installation endpoint, especially those originating from unexpected referrers.

Compensating Controls: Implement strict administrative session management and ensure that administrators are aware of the risks associated with clicking untrusted links while logged into the CMS backend.

Public Exploit Available: Unknown

The risk posed by this vulnerability is significant due to the potential for code-level modification of the CMS. Administrators should prioritize the update to version 5.21.2 as the primary method of mitigation. Failure to apply this patch leaves the system susceptible to unauthorized administrative actions that could result in a total loss of site integrity.