Drupal : Security Vulnerabilities Published In 2013 (CSRF)
The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs form validation even when CSRF validation has failed, which might allow remote attackers to trigger application-specific impacts such as arbitrary code execution via application-specific vectors.
| Max Base Score | 5.1 |
| Published | 2013-12-07 |
| Updated | 2014-01-14 |
| EPSS | 5.57% |
Cross-site request forgery (CSRF) vulnerability in the Aggregator module in Drupal 6.x before 6.23 and 7.x before 7.11 allows remote attackers to hijack the authentication of unspecified victims for requests that update feeds and possibly cause a denial of service (loss of updates due to rate limit) via unspecified vectors.
| Max Base Score | 6.8 |
| Published | 2013-10-28 |
| Updated | 2014-03-08 |
| EPSS | 0.09% |
2 vulnerabilities found