CVE-2009-3922: CSRF
Multiple cross-site request forgery (CSRF) vulnerabilities in the User Protect module 5.x before 5.x-1.4 and 6.x before 6.x-1.3, a module for Drupal, allow remote attackers to hijack the authentication of administrators for requests that (1) delete the editing protection of a user or (2) delete a certain type of administrative-bypass rule.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3922?
CVE-2009-3922 has a high severity rating as it allows remote attackers to perform unauthorized actions on behalf of an authenticated user.
How do I fix CVE-2009-3922?
To fix CVE-2009-3922, update the User Protect module to version 5.x-1.4 or 6.x-1.3 or later.
What are the implications of CVE-2009-3922 for my Drupal site?
CVE-2009-3922 can compromise the security of your Drupal site by allowing attackers to hijack the authentication of administrators.
Which versions of the User Protect module are affected by CVE-2009-3922?
CVE-2009-3922 affects User Protect module versions 5.x prior to 5.x-1.4 and 6.x prior to 6.x-1.3.
Is CVE-2009-3922 a known vulnerability in Drupal?
Yes, CVE-2009-3922 is a well-documented vulnerability that affects the User Protect module for Drupal.