Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2008-6532

Date: March 26, 2009

Multiple cross-site request forgery (CSRF) vulnerabilities in the update feature in Drupal 5.x before 5.13 and 6.x before 6.7 allow remote attackers to perform unauthorized actions as the superuser via unspecified vectors, as demonstrated by causing the superuser to "execute old updates" that modify the database.

Severity Score

Related Resources (11)

https://exchange.xforce.ibmcloud.com/vulnerabilities/47260
http://secunia.com/advisories/33112
http://www.osvdb.org/50661
http://www.vupen.com/english/advisories/2008/3414
http://drupal.org/node/345441
https://nvd.nist.gov/vuln/detail/CVE-2008-6532
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00740.html
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00767.html
https://people.canonical.com/~ubuntu-security/cve/CVE-2008-6532
http://secunia.com/advisories/33147
https://www.mend.io/vulnerability-database/CVE-2008-6532

Severity Score

Weakness Type (CWE)

Cross-Site Request Forgery (CSRF)

CWE-352

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): LOW

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): PARTIAL
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us