6.8
CVE-2007-6752
- EPSS 3.75%
- Veröffentlicht 28.03.2012 10:54:59
- Zuletzt bearbeitet 16.06.2026 22:48:42
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginCross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI. NOTE: the vendor disputes the significance of this issue, by considering the "security benefit against platform complexity and performance impact" and concluding that a change to the logout behavior is not planned because "for most sites it is not worth the trade-off.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 3.75% | 0.885 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.8 | 8.6 | 6.4 |
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
http://drupal.org/node/144538
http://groups.drupal.org/node/216314
http://ivanobinetti.blogspot.it/2012/03/drupal-cms-712-latest-stable-release.html
http://packetstormsecurity.org/files/110404/drupal712-xsrf.txt
http://www.exploit-db.com/exploits/18564/