CVE-2008-6532

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-03-26 · updated 2026-06-16
Weakness: CWE-352

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the update feature in Drupal 5.x before 5.13 and 6.x before 6.7 allow remote attackers to perform unauthorized actions as the superuser via unspecified vectors, as demonstrated by causing the superuser to "execute old updates" that modify the database.

Affected products

Drupal: 5.0, 5.1, 5.2, 5.3, 5.4, 5.5 (+14)

References

http://drupal.org/node/345441
http://secunia.com/advisories/33112
http://secunia.com/advisories/33147
http://www.osvdb.org/50661
http://www.vupen.com/english/advisories/2008/3414
https://exchange.xforce.ibmcloud.com/vulnerabilities/47260
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00740.html
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00767.html
http://drupal.org/node/345441
http://secunia.com/advisories/33112
http://secunia.com/advisories/33147
http://www.osvdb.org/50661

Get alerted when CVE-2008-6532 or the next vulnerability affects your stack