CVE-2015-6660

The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks…

published August 24, 2015

CVSS
—
EPSS
1%
Percentile
70.8
In the wild
Unconfirmed
What it is

The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01335 · 70.8th percentile
Published
2015-08-24T14:00Z
EPSS history
Timeline
  • 24 AUG 14:00Z
    The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks…
    cvelistv5