CSRF in Drupal Feature Module
CVE-2007-6320
Feature 4.7.x-dev and 5.x-dev before 20071206, a Drupal module, does not follow Drupal's Forms API submission model, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.007 (48.1th percentile) — read the EPSS interpretation.
Affected products
- Drupal Feature_module — versions 4.7.x_dev, 5.x_dev
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_OSVDB, vdb-entry)
- secalert@redhat.com (x_refsource_CONFIRM, Patch)