CVE-2008-0272

Drupal - CSRF

Title source: rule

Description

Cross-site request forgery (CSRF) vulnerability in the aggregator module in Drupal 4.7.x before 4.7.11 and 5.x before 5.6 allows remote attackers to delete items from a feed as privileged users.

References (9)

[Various Sources] http://drupal.org/node/208562

[Vendor Advisory] http://secunia.com/advisories/28422

[Patch] http://www.securityfocus.com/bid/27238

[Various Sources] http://www.vbdrupal.org/forum/showthread.php?p=6878

[Various Sources] http://www.vbdrupal.org/forum/showthread.php?t=1349

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/39617

[Third Party Advisory] http://secunia.com/advisories/28486

[Third Party Advisory] http://www.vupen.com/english/advisories/2008/0127

[Third Party Advisory] http://www.vupen.com/english/advisories/2008/0134

Scores

EPSS 0.0034

EPSS Percentile 56.1%

Classification

CWE

CWE-352

Status draft

Affected Products (48)

drupal/drupal

... and 33 more

Timeline

Published Jan 15, 2008

Tracked Since Feb 18, 2026