The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 02:35
Type | Values Removed | Values Added |
---|---|---|
References | () http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165061.html - | |
References | () http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165690.html - | |
References | () http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165704.html - | |
References | () http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165723.html - | |
References | () http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165733.html - | |
References | () http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165840.html - | |
References | () http://www.debian.org/security/2015/dsa-3346 - | |
References | () http://www.securitytracker.com/id/1033358 - | |
References | () https://www.drupal.org/SA-CORE-2015-003 - Patch, Vendor Advisory |
Information
Published : 2015-08-24 14:59
Updated : 2024-11-21 02:35
NVD link : CVE-2015-6660
Mitre link : CVE-2015-6660
CVE.ORG link : CVE-2015-6660
JSON object : View
Products Affected
drupal
- drupal
CWE
CWE-352
Cross-Site Request Forgery (CSRF)