Cross-site request forgery in Drupal Drupal

1) Cross-site request forgery

EUVDB-ID: #VU533

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

Description

The vulnerability exposes possibility of cross-site request forgery performing.
The weakness exists due to insuffiecient checking of the sent requests. To exloit the vulnerability attackers can trigger a superuser to execute old updates that damages the database and may lead to CSFP.
Successful exploitatin of the vulnerability may result in cross-site request forgery conducting.

Mitigation

Update 5.x to 5.13.
http://ftp.drupal.org/files/projects/drupal-5.13.tar.gz
Update 6.x to 6.7.
http://ftp.drupal.org/files/projects/drupal-6.7.tar.gz

Vulnerable software versions

Drupal: 5.0 - 6.6

CPE2.3

• cpe:2.3:a:drupal:drupal:5.12:*:*:*:*:*:*:*
• cpe:2.3:a:drupal:drupal:6.6:*:*:*:*:*:*:*

External links

http://www.drupal.org/node/345441

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.