CVE-2008-3743

Drupal 6.x < 6.4 - Cross-Site Request Forgery via Cached Forms and AHAH Elements

Title source: llm
STIX 2.1

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in forms in Drupal 6.x before 6.4 allow remote attackers to perform unspecified actions via unknown vectors, related to improper token validation for (1) cached forms and (2) forms with AHAH elements.

References (9)

Core 9
Core References
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=459108
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/30689
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/44453
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31825
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/2392
Various Sources x_refsource_confirm
http://drupal.org/node/295053
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31462

Scores

EPSS 0.0057
EPSS Percentile 68.7%

Details

CWE
CWE-352
Status published
Products (4)
drupal/drupal 6.0
drupal/drupal 6.1
drupal/drupal 6.2
drupal/drupal 6.3
Published Aug 27, 2008
Tracked Since Feb 18, 2026