CVE-2006-5476: CSRF

Published Oct 24, 2006

Updated

Cross-site request forgery (CSRF) vulnerability in Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allows remote attackers to perform unauthorized actions as an arbitrary user via unspecified vectors.

Affected Software

14 affected components

Drupal Drupal=4.6.0

Drupal Drupal=4.6.5

Drupal Drupal=4.7.2

Drupal Drupal=4.6.9

Drupal Drupal=4.6.2

Drupal Drupal=4.6.8

Drupal Drupal=4.7.3

Drupal Drupal=4.6.3

Drupal Drupal=4.6.4

Drupal Drupal=4.7.0

Drupal Drupal=4.6.7

Drupal Drupal=4.6.1

Drupal Drupal=4.7.1

Drupal Drupal=4.6.6

Event History

Oct 24, 2006

CVE Published

08:07 PM

Data Sourced

via NVD·08:07 PM

DescriptionSeverityAffected Software

Oct 25, 2006

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-5476?

The severity of CVE-2006-5476 is classified as moderate due to the potential for unauthorized actions by remote attackers.

How do I fix CVE-2006-5476?

To fix CVE-2006-5476, upgrade your Drupal installation to version 4.6.10 or later for the 4.6.x series, or to version 4.7.4 or later for the 4.7.x series.

Which versions of Drupal are affected by CVE-2006-5476?

CVE-2006-5476 affects Drupal versions 4.6.0 through 4.6.9 and 4.7.0 through 4.7.3.

What type of vulnerability is CVE-2006-5476?

CVE-2006-5476 is classified as a Cross-site request forgery (CSRF) vulnerability.

Can CVE-2006-5476 be exploited remotely?

Yes, CVE-2006-5476 can be exploited remotely by attackers to perform unauthorized actions as arbitrary users.