CVE-2011-1664: CSRF
Published Apr 10, 2011
·Updated
Cross-site request forgery (CSRF) vulnerability in the Translation Management module 6.x before 6.x-1.21 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Affected Software
21 affected components
Icanlocalize Translation Management=6.x-1.0
Icanlocalize Translation Management=6.x-1.0-beta1
Icanlocalize Translation Management=6.x-1.0-beta2
Icanlocalize Translation Management=6.x-1.0-beta3
Icanlocalize Translation Management=6.x-1.0-beta4
Icanlocalize Translation Management=6.x-1.0-beta5
Icanlocalize Translation Management=6.x-1.0-beta6
Icanlocalize Translation Management=6.x-1.0-beta7
Icanlocalize Translation Management=6.x-1.1
Icanlocalize Translation Management=6.x-1.2
Icanlocalize Translation Management=6.x-1.2-beta1
Icanlocalize Translation Management=6.x-1.3
Icanlocalize Translation Management=6.x-1.4
Icanlocalize Translation Management=6.x-1.5
Icanlocalize Translation Management=6.x-1.6
Icanlocalize Translation Management=6.x-1.7
Icanlocalize Translation Management=6.x-1.8
Icanlocalize Translation Management=6.x-1.9
Icanlocalize Translation Management=6.x-1.20
Icanlocalize Translation Management=6.x-1.x-dev
Drupal Drupal
Remediation
Patch Available
Event History
Apr 10, 2011
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Data Sourced
02:51 AM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
Which deployments are affected?
Drupal sites using the Translation Management module 6.x before version 6.x-1.21 are affected.
2
What does an attacker need to exploit this issue?
The vulnerability is remotely exploitable without authentication, but it relies on CSRF and therefore involves hijacking the authentication of a victim. The specific attack vectors are not identified in the available information.
3
Is a fix available?
Yes. A patch is available; update the Translation Management module to version 6.x-1.21 or later.