Description

Drupal 5.x before 5.3 does not apply its Drupal Forms API protection against the user deletion form, which allows remote attackers to delete users via a cross-site request forgery (CSRF) attack.

Remediation

References

CVE-2007-5594

Related Vulnerabilities

PrestaShop Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-5682)

Atlassian Confluence Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-18084)

Apache HTTP Server Other Vulnerability (CVE-2003-0987)

WordPress Plugin Lingotek Translation Multiple Cross-Site Scripting Vulnerabilities (1.1.8)

Drupal Core 9.4.x Security Bypass (9.4.0 - 9.4.2)

Severity

Medium

Classification

CVE-2007-5594 CWE-352

Tags

Missing Update Known Vulnerabilities