CVE-2007-6320 Feature 4.7.x-dev and 5.x-dev before 20071206, a Drupal module, does not follow Drupal's Forms API submission model, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks.
MediumCVSS 4.3
EPSS 0.67%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Feature 4.7.x-dev and 5.x-dev before 20071206, a Drupal module, does not follow Drupal's Forms API submission model, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal feature module | = 4.7.x_dev | No fix listed |
| drupal feature module | = 5.x_dev | No fix listed |
References
- drupal.org patch
- 43671 vdb-entry