> DESCRIPTION
Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions. An unauthorized backend user or CSRF attack could install, update or remove extensions.
> CWE DETAILED DESCRIPTIONS
CWE-284: Improper Access Control - The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. | CWE-352: Cross-Site Request Forgery - The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.