CVE-2008-3744: CSRF
Published Aug 27, 2008
·Updated
Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.10 and 6.x before 6.4 allow remote attackers to hijack the authentication of administrators for requests that (1) add or (2) delete user access rules.
Affected Software
14 affected components
Drupal Drupal=5.0
Drupal Drupal=5.1
Drupal Drupal=5.2
Drupal Drupal=5.3
Drupal Drupal=5.4
Drupal Drupal=5.5
Drupal Drupal=5.6
Drupal Drupal=5.7
Drupal Drupal=5.8
Drupal Drupal=5.9
Drupal Drupal=6.0
Drupal Drupal=6.1
Drupal Drupal=6.2
Drupal Drupal=6.3
Remediation
Patch Available
Event History
Aug 27, 2008
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-3744?
CVE-2008-3744 is considered a high severity vulnerability due to the ability of remote attackers to hijack authentication of administrators.
2
How do I fix CVE-2008-3744?
To fix CVE-2008-3744, upgrade to Drupal version 5.10 or 6.4 or later to eliminate the CSRF vulnerabilities.
3
Which versions of Drupal are affected by CVE-2008-3744?
CVE-2008-3744 affects Drupal versions 5.0 to 5.9 and versions 6.0 to 6.3.
4
Can CVE-2008-3744 be exploited without user interaction?
Yes, CVE-2008-3744 can be exploited remotely without requiring user interaction.
5
What types of attacks can be executed due to CVE-2008-3744?
CVE-2008-3744 allows attackers to perform unauthorized actions such as adding or deleting user access rules.