Unscored CVE-2007-5594 EUVD-2007-5569GHSA-f8mj-2m92-pmqv

Drupal 5.x before 5.3 does not apply its Drupal Forms API protection against the user deletion form, which allows remote attackers to delet…

Published Oct 19, 2007 · Updated Aug 7, 2024 · Assigned by mitre

Description

Drupal 5.x before 5.3 does not apply its Drupal Forms API protection against the user deletion form, which allows remote attackers to delete users via a cross-site request forgery (CSRF) attack.

References

http://drupal.org/node/184348
drupal-http-request-csrf(37268) vdb-entry
FEDORA-2007-2649 vendor-advisory
27352 third-party-advisory
27290 third-party-advisory
26119 vdb-entry