CVE-2015-6660: CSRF
The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-6660?
CVE-2015-6660 is considered a moderate severity vulnerability due to its potential for cross-site request forgery (CSRF) attacks.
How do I fix CVE-2015-6660?
To fix CVE-2015-6660, you need to upgrade to Drupal version 6.37 or 7.39 or later where the token validation has been properly implemented.
What does CVE-2015-6660 exploit?
CVE-2015-6660 exploits the Form API in Drupal by allowing remote attackers to upload files to another user's account.
Which versions of Drupal are affected by CVE-2015-6660?
CVE-2015-6660 affects Drupal versions 6.x before 6.37 and 7.x before 7.39.
What are the potential impacts of CVE-2015-6660?
The potential impacts of CVE-2015-6660 include unauthorized file uploads and possible data integrity issues due to CSRF attacks.