CVE-2009-2572

Fivestar module for Drupal 5.x-1.x-6.x-1.x - Cross-Site Request Forgery

Title source: llm

Description

Cross-site request forgery (CSRF) vulnerability in the Fivestar module 5.x-1.x before 5.x-1.14 and 6.x-1.x before 6.x-1.14, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users for requests that cast votes.

References (7)

Core 7

Core References

Vendor Advisory x_refsource_confirm

http://drupal.org/node/449028

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/50245

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/54154

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/34956

Patch, Vendor Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2009/1215

Patch, Vendor Advisory x_refsource_confirm

http://drupal.org/node/449042

Vendor Advisory x_refsource_confirm

http://drupal.org/node/449026

Scores

EPSS 0.0072

EPSS Percentile 49.6%

Details

CWE

CWE-352

Status published

Products (8)

lullabot/fivestar_module_for_drupal 5.x-1.9

lullabot/fivestar_module_for_drupal 5.x-1.10

lullabot/fivestar_module_for_drupal 5.x-1.11 (5 CPE variants)

lullabot/fivestar_module_for_drupal 5.x-1.12

lullabot/fivestar_module_for_drupal 5.x-1.13

lullabot/fivestar_module_for_drupal 6.x-1.11 beta3 (3 CPE variants)

lullabot/fivestar_module_for_drupal 6.x-1.12 (2 CPE variants)

lullabot/fivestar_module_for_drupal 6.x-1.13

Published Jul 22, 2009

Tracked Since Feb 18, 2026