CVE-2008-3743

EPSS 0.43%
Published 27.08.2008 15:21:00
Last modified 09.04.2025 00:30:58
Source cve@mitre.org
Teams watchlist Login
Open Login

Multiple cross-site request forgery (CSRF) vulnerabilities in forms in Drupal 6.x before 6.4 allow remote attackers to perform unspecified actions via unknown vectors, related to improper token validation for (1) cached forms and (2) forms with AHAH elements.

Affected products Warnungen 0 Metrics 2 CWE 1 References 12

Data is provided by the National Vulnerability Database (NVD)

Drupal ≫ Drupal Version6.0

Drupal ≫ Drupal Version6.1

Drupal ≫ Drupal Version6.2

Drupal ≫ Drupal Version6.3

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.43%	0.621

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5.8	8.6	4.9	AV:N/AC:M/Au:N/C:N/I:P/A:P

CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

http://drupal.org/node/295053

http://secunia.com/advisories/31462

http://secunia.com/advisories/31825

http://www.securityfocus.com/bid/30689

http://www.vupen.com/english/advisories/2008/2392

https://bugzilla.redhat.com/show_bug.cgi?id=459108

https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00259.html

https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00508.html

https://exchange.xforce.ibmcloud.com/vulnerabilities/44453

https://nvd.nist.gov/vuln/detail/CVE-2008-3743

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2008-3743

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2008-3743

EUVD