CVE-2008-3743 Cross-site request forgery in n/a
Remote attackers can perform unauthorized actions on behalf of authenticated users via CSRF in Drupal 6.x forms.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2008-3743?
CVE-2008-3743 is a medium-severity vulnerability in Drupal Drupal, published on 27 Aug 2008. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Multiple cross-site request forgery (CSRF) vulnerabilities in forms in Drupal 6.x before 6.4 allow remote attackers to perform unspecified actions via unknown vectors, related to improper token validation for (1) cached forms and (2) forms with AHAH elements.
Weakness: CWE-352
Which versions are affected by CVE-2008-3743?
It affects 1 product.
Products include Drupal Drupal.
How do I fix CVE-2008-3743?
Upgrade to a fixed version.
Is CVE-2008-3743 being exploited?
There is no known exploitation of CVE-2008-3743 in the wild and no public exploit code.
Other vulnerabilities in Drupal Drupal
Sources
Also known as GHSA-82c6-j98m-2vfw.