CVE-2015-6660 Cross-site request forgery in n/a
Remote attackers can exploit a CSRF vulnerability in Drupal's Form API to upload files to another user's account, requiring victim interaction.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2015-6660?
CVE-2015-6660 is a medium-severity vulnerability in Drupal Drupal, published on 24 Aug 2015. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."
Weakness: CWE-352
Which versions are affected by CVE-2015-6660?
It affects 1 product.
Products include Drupal Drupal.
How do I fix CVE-2015-6660?
Upgrade to a fixed version.
Is CVE-2015-6660 being exploited?
There is no known exploitation of CVE-2015-6660 in the wild and no public exploit code.
Other vulnerabilities in Drupal Drupal
Sources
Also known as GHSA-vfw4-2ffw-69gw, UBUNTU-CVE-2015-6660.