CVE

Id
28951  
CVE No.
CVE-2007-5594  
Status
Candidate  
Description
Drupal 5.x before 5.3 does not apply its Drupal Forms API protection against the user deletion form, which allows remote attackers to delete users via a cross-site request forgery (CSRF) attack.  
Phase
Assigned (20071019)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
303360 28951 CVE-2007-5594 CONFIRM:http://drupal.org/node/184348  View
303361 28951 CVE-2007-5594 FEDORA:FEDORA-2007-2649  View
303362 28951 CVE-2007-5594 URL:https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00328.html  View
303363 28951 CVE-2007-5594 BID:26119  View
303364 28951 CVE-2007-5594 URL:http://www.securityfocus.com/bid/26119  View
303365 28951 CVE-2007-5594 SECUNIA:27290  View
303366 28951 CVE-2007-5594 URL:http://secunia.com/advisories/27290  View
303367 28951 CVE-2007-5594 SECUNIA:27352  View
303368 28951 CVE-2007-5594 URL:http://secunia.com/advisories/27352  View
303369 28951 CVE-2007-5594 XF:drupal-http-request-csrf(37268)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
54124 JVNDB-2007-002816 Drupal のコア Upload モジュールにおけるクロスサイトスクリプティング攻撃を誘発する脆弱性 Drupal のコア Upload モジュールは、ホワイトリスト上に .html 拡張子を配置するため、クロスサイトスクリプティング攻撃を誘発する脆弱性が存在します。 CVE-2007-5596 28951 4.3 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-002816.html  View