{"id":"CVE-2007-6752","aliases":["EUVD-2007-6708","GHSA-jchx-5q5h-f574","UBUNTU-CVE-2007-6752"],"status":"disputed","title":"** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows...","description":"Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI.  NOTE: the vendor disputes the significance of this issue, by considering the \"security benefit against platform complexity and performance impact\" and concluding that a change to the logout behavior is not planned because \"for most sites it is not worth the trade-off.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03707,"percentile":0.89822,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-352"],"published":"2012-03-28T10:00:00Z","modified":"2026-06-16T22:48:42Z","exploits":[{"source":"exploitdb","id":"EDB-18564","title":"Drupal 7.12 - Multiple Vulnerabilities","type":"webapps","platform":"php","date":"2012-03-02","url":"https://www.exploit-db.com/exploits/18564"}],"affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.23-1","7.24-1","7.24-2","7.26-1","7.26-1ubuntu0.1","7.26-1ubuntu0.1+esm1","7.26-1ubuntu0.1+esm2","7.26-1ubuntu0.1+esm3"]}],"products":[{"vendor":"drupal","product":"drupal"}],"references":[{"url":"http://ivanobinetti.blogspot.it/2012/03/drupal-cms-712-latest-stable-release.html","tags":["x_refsource_MISC","x_transferred","report"]},{"url":"http://groups.drupal.org/node/216314","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","report"]},{"url":"http://drupal.org/node/144538","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","report"]},{"url":"http://www.exploit-db.com/exploits/18564/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","report"]},{"url":"http://packetstormsecurity.org/files/110404/drupal712-xsrf.txt","tags":["x_refsource_MISC","x_transferred","Exploit","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-6752"},{"url":"http://www.exploit-db.com/exploits/18564"},{"url":"https://github.com/advisories/GHSA-jchx-5q5h-f574"},{"url":"https://ubuntu.com/security/CVE-2007-6752","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-6752","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2007-6752","description":"Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI.  NOTE: the vendor disputes the significance of this issue, by considering the \"security benefit against platform complexity and performance impact\" and concluding that a change to the logout behavior is not planned because \"for most sites it is not worth the trade-off.","status":"disputed","published":"2012-03-28T10:00:00Z","modified":"2024-09-17T00:41:33.268Z","updated_at":"2026-11-02T13:33:07.91528Z"}],"euvd":[{"id":"EUVD-2007-6708","description":"Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI.  NOTE: the vendor disputes the significance of this issue, by considering the \"security benefit against platform complexity and performance impact\" and concluding that a change to the logout behavior is not planned because \"for most sites it is not worth the trade-off.","status":"published","published":"2012-03-28T10:00:00Z","modified":"2024-09-17T00:41:33Z","updated_at":"2026-11-03T00:28:56.965297Z"}],"ghsa":[{"id":"GHSA-jchx-5q5h-f574","title":"** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows...","description":"** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI.  NOTE: the vendor disputes the significance of this issue, by considering the \"security benefit against platform complexity and performance impact\" and concluding that a change to the logout behavior is not planned because \"for most sites it is not worth the trade-off.\"","status":"published","published":"2022-05-01T18:46:11Z","modified":"2024-03-21T03:33:10Z","cwes":["CWE-352"],"updated_at":"2026-11-02T14:55:41.504227Z"}],"nvd":[{"id":"CVE-2007-6752","description":"Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI.  NOTE: the vendor disputes the significance of this issue, by considering the \"security benefit against platform complexity and performance impact\" and concluding that a change to the logout behavior is not planned because \"for most sites it is not worth the trade-off.","status":"disputed","published":"2012-03-28T10:54:59.457Z","modified":"2026-06-16T22:48:42Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:01:24.391698Z"}],"osv":[{"id":"UBUNTU-CVE-2007-6752","description":"Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI.  NOTE: the vendor disputes the significance of this issue, by considering the \"security benefit against platform complexity and performance impact\" and concluding that a change to the logout behavior is not planned because \"for most sites it is not worth the trade-off.","status":"published","published":"2012-03-28T10:54:00Z","modified":"2025-09-08T16:42:50Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}