CVE-2015-3349: CSRF
Multiple cross-site request forgery (CSRF) vulnerabilities in the Htaccess module before 7.x-2.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) deploy or (2) delete an .htaccess file via unspecified vectors.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3349?
CVE-2015-3349 is considered a medium severity vulnerability due to the potential for remote attackers to hijack administrator authentication.
How can I fix CVE-2015-3349?
To fix CVE-2015-3349, update the Htaccess module to version 7.x-2.3 or later.
What types of attacks are possible with CVE-2015-3349?
CVE-2015-3349 allows attackers to execute cross-site request forgery attacks to deploy or delete .htaccess files.
Which versions of the Htaccess module are affected by CVE-2015-3349?
CVE-2015-3349 affects the Htaccess module versions prior to 7.x-2.3.
Who is primarily impacted by CVE-2015-3349?
Administrators of Drupal sites using vulnerable versions of the Htaccess module are primarily impacted by CVE-2015-3349.