Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrar…

Published 14 y ago 2012-03-28 · modified 4 mo ago 2026-06-16 · JSON

CVSS

6.8

v2.0 · NVD

CISA KEV

not known exploited

EPSS

3.7%

percentile 90%

Public exploits

Exploit-DB

Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI. NOTE: the vendor disputes the significance of this issue, by considering the "security benefit against platform complexity and performance impact" and concluding that a change to the logout behavior is not planned because "for most sites it is not worth the trade-off.

Exploit prediction (EPSS)

3.71% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.

Exploits and detections

EDB-18564 Drupal 7.12 - Multiple Vulnerabilities · webapps · 2012-03-02

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`

Classification

Weakness

CWE-352 Cross-Site Request Forgery

References

ivanobinetti.blogspot.it /2012/03/drupal-cms-712-latest-stable-release.html · x_refsource_MISC, x_transferred
groups.drupal.org /node/216314 · x_refsource_MISC, x_transferred
drupal.org /node/144538 · x_refsource_MISC, x_transferred
exploit-db.com /exploits/18564/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
packetstormsecurity.org /files/110404/drupal712-xsrf.txt · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2007-6752
NVD: CVE-2007-6752

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.