Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the update feature in Drupal 5.x before 5.13 and 6.x before 6.7 allow remote attackers to perform unauthorized actions as the superuser via unspecified vectors, as demonstrated by causing the superuser to "execute old updates" that modify the database.

Remediation

References

CVE-2008-6532

Related Vulnerabilities

WordPress Plugin Slideshow Gallery LITE Multiple Vulnerabilities (1.5.1)

PHP Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') Vulnerability (CVE-2001-1246)

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-0244)

MySQL Other Vulnerability (CVE-2005-2573)

b2evolution Other Vulnerability (CVE-2006-6197)

Severity

Medium

Classification

CVE-2008-6532 CWE-352

Tags

Missing Update Known Vulnerabilities