CVE-2007-6752: CSRF
DISPUTED Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI. NOTE: the vendor disputes the significance of this issue, by considering the "security benefit against platform complexity and performance impact" and concluding that a change to the logout behavior is not planned because "for most sites it is not worth the trade-off."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-6752?
The severity of CVE-2007-6752 is generally considered medium due to its potential for cross-site request forgery.
How do I fix CVE-2007-6752?
To fix CVE-2007-6752, update your Drupal installation to a version later than 7.12.
Which versions of Drupal are affected by CVE-2007-6752?
CVE-2007-6752 affects Drupal versions 7.12 and earlier, as well as several earlier versions of the Drupal 4, 5, and 6 series.
What type of vulnerability is CVE-2007-6752?
CVE-2007-6752 is a cross-site request forgery (CSRF) vulnerability that allows attackers to hijack user sessions.
Can CVE-2007-6752 be exploited remotely?
Yes, CVE-2007-6752 can be exploited remotely by attackers to terminate user sessions without their consent.