Cross-site request forgery in Drupal - #VU578

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU578

Cross-site request forgery in Drupal - #VU578

Published: September 21, 2016


Vulnerability identifier: #VU578
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: Drupal
Affected software:
Drupal

Detailed vulnerability description

The vulnerability allows a remote user to perform cross-site request forgery attack.
The weakness is caused by improper access control. After tricking the victim into visiting specially crafted URL(s), attackers can change passwords, post PHP code or create new users.
Successful exploitation of the vulnerability enables a malicious user to conduct CSRF attack.

Remediation


Sources