TangoCMS 2.2.0 Closes Security Holes

During their current development cycle, the TangoCMS team found a number of security problems and decided to release "Eagle" with the express goal of resolving them. Planned enhancements such as a simple WYSIWYG content editor and improved page layout will have to wait until version 2.3.0 due out in mid-2009, according to their roadmap.

An entry in the TangoCMS bug tracker identifies the issue as being one of Cross-Site-Request Forgery (CSRF) in a number of instances. The vulnerabilities also affected previous versions, for which the project can't provide details for obvious security reasons.

A CSRF attack forces an authenticated web application user to execute unwanted actions of the attacker’s choosing, possibly compromising the user's data. The attack typically results from a link or a graphic URL that the attacker sneaks into the background. Especially vulnerable are attacks on privileged users such as web administrators. Attackers can actually use the privileges to wipe out content or even accounts. The Open Web Application Security Project (OWASP) has further details on CSRF attacks, also known as XSRF and “session riding,” among other names.

TangoCMS is available for download as a tarball. The site also describes how to check out the PHP source code from the project's Subversion repository.