CVE-2007-6752
Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Drupal 7.12 - Multiple Vulnerabilities2012-03-02 · webapps · php
Impact
Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI. NOTE: the vendor disputes the significance of this issue, by considering the "security benefit against platform complexity and performance impact" and concluding that a change to the logout behavior is not planned because "for most sites it is not worth the trade-off.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Drupal | Drupal | through 7.12 Versions 4.0, 4.0.0, 4.1.0, 4.2.0_rc, 4.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://drupal.org/node/144538
- http://groups.drupal.org/node/216314
- http://ivanobinetti.blogspot.it/2012/03/drupal-cms-712-latest-stable-release.html
- http://packetstormsecurity.org/files/110404/drupal712-xsrf.txt
- http://www.exploit-db.com/exploits/18564/
- http://drupal.org/node/144538
- http://groups.drupal.org/node/216314
- http://ivanobinetti.blogspot.it/2012/03/drupal-cms-712-latest-stable-release.html
- http://packetstormsecurity.org/files/110404/drupal712-xsrf.txt
- http://www.exploit-db.com/exploits/18564/