CVE-2008-3744

Drupal 5.x < 5.10 and 6.x < 6.4 - Cross-Site Request Forgery

Title source: llm
STIX 2.1

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.10 and 6.x before 6.4 allow remote attackers to hijack the authentication of administrators for requests that (1) add or (2) delete user access rules.

References (9)

Core 9
Core References
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=459108
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/30689
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31825
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/44448
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/2392
Patch x_refsource_confirm
http://drupal.org/node/295053
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31462

Scores

EPSS 0.0027
EPSS Percentile 50.1%

Details

CWE
CWE-352
Status published
Products (14)
drupal/drupal 5.0
drupal/drupal 5.1
drupal/drupal 5.2
drupal/drupal 5.3
drupal/drupal 5.4
drupal/drupal 5.5
drupal/drupal 5.6
drupal/drupal 5.7
drupal/drupal 5.8
drupal/drupal 5.9
... and 4 more
Published Aug 27, 2008
Tracked Since Feb 18, 2026