PT-2015-6175 · Drupal · Drupal

Pere Orga · Published 2015-04-21 · Updated 2016-12-06 · CVE-2015-3354

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 6.x-2.7 Drupal versions 7.x-2.x prior to 7.x-2.7

Description A cross-site request forgery (CSRF) issue exists in the Wishlist module, allowing remote attackers to hijack the authentication of arbitrary users for requests that delete wishlist purchase intentions.

Recommendations For versions prior to 6.x-2.7, update to version 6.x-2.7 or later. For versions 7.x-2.x prior to 7.x-2.7, update to version 7.x-2.7 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2015-3354

Affected Products

Drupal

References · 6

• https://drupal.org/node/2406811 · Patch
• https://drupal.org/node/2407313 · Vendor Advisory
• https://drupal.org/node/2406803 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-3354 · Security Note
• http://securityfocus.com/bid/72114 · Note
• http://openwall.com/lists/oss-security/2015/01/29/6 · Note