CVE-2007-6752

Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI. NOTE: the vendor disputes the significance of this issue, by considering the "security benefit against platform complexity and performance impact" and concluding that a change to the logout behavior is not planned because "for most sites it is not worth the trade-off.

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

3.71% chance of exploitation in the next 30 days, 89th percentile

Published

2012-03-28

Updated

2024-09-17

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/18564/

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/18564

References

• CVE Record
• NVD entry

Related

• CVE-2007-6750
• CVE-2007-6758
• CVE-2007-6731
• CVE-2007-6704
• CVE-2007-6702
• CVE-2007-6700