CVE-2009-1576: CSRF
Unspecified vulnerability in Drupal 5.x before 5.17 and 6.x before 6.11, as used in vbDrupal before 5.17.0, allows user-assisted remote attackers to obtain sensitive information by tricking victims into visiting the front page of the site with a crafted URL and causing form data to be sent to an attacker-controlled site, possibly related to multiple / (slash) characters that are not properly handled by includes/bootstrap.inc, as demonstrated using the search box. NOTE: this vulnerability can be leveraged to conduct cross-site request forgery (CSRF) attacks.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1576?
CVE-2009-1576 has a medium severity rating due to its user-assisted exploitation nature.
How do I fix CVE-2009-1576?
To fix CVE-2009-1576, upgrade to Drupal versions 5.17 or 6.11 or later.
Who is affected by CVE-2009-1576?
CVE-2009-1576 affects users of Drupal versions prior to 5.17 and 6.11.
What type of vulnerability is CVE-2009-1576?
CVE-2009-1576 is an unspecified vulnerability that can lead to sensitive information disclosure.
Is there a workaround for CVE-2009-1576?
There is no known workaround for CVE-2009-1576; upgrading is the recommended solution.