PT-2015-7311 · Drupal · Drupal

Abdullah Hussam · Published 2015-08-24 · Updated 2016-12-24 · CVE-2015-6660

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x before 6.37 Drupal versions 7.x before 7.39

Description The issue concerns the Form API in Drupal, which fails to properly validate the form token. This allows remote attackers to conduct CSRF attacks, enabling them to upload files into a different user's account. The attack vectors are related to "file upload value callbacks."

Recommendations For Drupal 6.x, update to version 6.37 or later. For Drupal 7.x, update to version 7.39 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2015-6660

DSA-3346-1

MGASA-2015-0328

Affected Products

Drupal

References · 28

• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165061.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6661 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165704.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/drupal7 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-6660 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165840.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6660 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-6660 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165733.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0328 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3346-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6665 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-6660 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6658 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165690.html · Vendor Advisory