CVE-2007-6752

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-03-28 · updated 2026-06-16
Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI. NOTE: the vendor disputes the significance of this issue, by considering the "security benefit against platform complexity and performance impact" and concluding that a change to the logout behavior is not planned because "for most sites it is not worth the trade-off.

Affected products

Drupal: through 7.12; 4.0, 4.0.0, 4.1.0, 4.2.0_rc, 4.4, 4.4.0 (+141)

References

http://drupal.org/node/144538
http://groups.drupal.org/node/216314
http://ivanobinetti.blogspot.it/2012/03/drupal-cms-712-latest-stable-release.html
http://packetstormsecurity.org/files/110404/drupal712-xsrf.txt
http://www.exploit-db.com/exploits/18564/
http://drupal.org/node/144538
http://groups.drupal.org/node/216314
http://ivanobinetti.blogspot.it/2012/03/drupal-cms-712-latest-stable-release.html
http://packetstormsecurity.org/files/110404/drupal712-xsrf.txt
http://www.exploit-db.com/exploits/18564/

Get alerted when CVE-2007-6752 or the next vulnerability affects your stack