CVE-2010-1547
Chaos Tool Suite CTools 6.x < 1.4 - Cross-Site Request Forgery via Page Enable/Disable
Title source: llmDescription
Multiple cross-site request forgery (CSRF) vulnerabilities in the Chaos Tool Suite (aka CTools) module 6.x before 6.x-1.4 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) enable a page via a q=admin/build/pages/nojs/enable/ value or (2) disable a page via a q=admin/build/pages/nojs/disable/ value.
References (6)
Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/58722
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/39884
Mailing List mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2010/May/272
Patch, Vendor Advisory x_refsource_confirm
http://drupal.org/node/803944
Patch vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/40285
Various Sources x_refsource_misc
http://www.madirish.net/?article=458
Scores
EPSS
0.0067
EPSS Percentile
47.7%
Details
CWE
CWE-352
Status
published
Products (5)
chaos_tool_suite_project/ctools
6.x-1.0 (9 CPE variants)
chaos_tool_suite_project/ctools
6.x-1.1
chaos_tool_suite_project/ctools
6.x-1.2
chaos_tool_suite_project/ctools
6.x-1.3
chaos_tool_suite_project/ctools
6.x-1.x dev
Published
May 21, 2010
Tracked Since
Feb 18, 2026