{"id":"CVE-2015-6660","aliases":["DSA-3346-1","EUVD-2015-6598","GHSA-vfw4-2ffw-69gw","MGASA-2015-0328","UBUNTU-CVE-2015-6660"],"status":"published","title":"The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form...","description":"The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to \"file upload value callbacks.\"","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01335,"percentile":0.71355,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2015-08-24T14:00:00Z","modified":"2026-06-17T00:31:12Z","affected":[{"source":"osv","ecosystem":"Debian:7","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14-2+deb7u11"}]}],"versions":["7.14-2","7.14-2+deb7u1","7.14-2+deb7u10","7.14-2+deb7u10~bpo60+1","7.14-2+deb7u11~bpo60+1","7.14-2+deb7u1~bpo60+1","7.14-2+deb7u2","7.14-2+deb7u2~bpo60+1","7.14-2+deb7u3","7.14-2+deb7u4","7.14-2+deb7u4~bpo60+1","7.14-2+deb7u5","7.14-2+deb7u6","7.14-2+deb7u6~bpo60+1","7.14-2+deb7u7","7.14-2+deb7u7~bpo60+1","7.14-2+deb7u8","7.14-2+deb7u9","7.14-2+deb7u9~bpo60+1"],"bundled":5},{"source":"osv","ecosystem":"Debian:8","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.32-1+deb8u5"}]}],"versions":["7.32-1+deb8u3","7.32-1+deb8u4","7.32-1+deb8u4~bpo70+1","7.32-1+deb8u5~bpo70+1"],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.39-1.mga4"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.39-1.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.23-1","7.24-1","7.24-2","7.26-1","7.26-1ubuntu0.1","7.26-1ubuntu0.1+esm1","7.26-1ubuntu0.1+esm2","7.26-1ubuntu0.1+esm3"]}],"products":[{"vendor":"drupal","product":"drupal"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165723.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165061.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://www.securitytracker.com/id/1033358","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165840.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165733.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://www.debian.org/security/2015/dsa-3346","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://www.drupal.org/SA-CORE-2015-003","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165690.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165704.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-6660"},{"url":"https://github.com/advisories/GHSA-vfw4-2ffw-69gw"},{"url":"https://advisories.mageia.org/MGASA-2015-0328.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16630","tags":["report"]},{"url":"https://www.drupal.org/drupal-7.39","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.39-release-notes","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-6660","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-6660","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-6660","description":"The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to \"file upload value callbacks.\"","status":"published","published":"2015-08-24T14:00:00Z","modified":"2024-08-06T07:29:23.161Z","updated_at":"2026-11-02T14:35:42.680858Z"}],"euvd":[{"id":"EUVD-2015-6598","description":"The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to \"file upload value callbacks.\"","status":"published","published":"2015-08-24T14:00:00Z","modified":"2024-08-06T07:29:23Z","updated_at":"2026-11-03T02:21:55.290228Z"}],"ghsa":[{"id":"GHSA-vfw4-2ffw-69gw","title":"The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form...","description":"The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to \"file upload value callbacks.\"","status":"published","published":"2022-05-17T03:15:48Z","modified":"2023-01-27T05:07:02Z","cwes":["CWE-352"],"updated_at":"2026-11-02T14:43:02.280319Z"}],"nvd":[{"id":"CVE-2015-6660","description":"The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to \"file upload value callbacks.\"","status":"published","published":"2015-08-24T14:59:17.54Z","modified":"2026-06-17T00:31:12.023Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:03:08.998581Z"}],"osv":[{"id":"DSA-3346-1","title":"drupal7 - security update","status":"published","published":"2015-08-31T00:00:00Z","modified":"2026-03-09T01:21:12.171232Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0328","title":"Updated drupal packages fix security vulnerabilities","description":"Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal\nbefore 7.39 allows remote attackers to inject arbitrary web script or HTML\nvia a crafted URL, related to uploading files (CVE-2015-6658).\n\nSQL injection vulnerability in the SQL comment filtering system in the\nDatabase API in Drupal before 7.39 allows remote attackers to execute\narbitrary SQL commands via an SQL comment (CVE-2015-6659).\n\nThe Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly\nvalidate the form token, which allows remote attackers to conduct CSRF\nattacks that upload files in a different user's account via vectors related\nto \"file upload value callbacks\" (CVE-2015-6660).\n\nDrupal before 7.39 allows remote attackers to obtain sensitive node titles by\nreading the menu (CVE-2015-6661).\n\nCross-site scripting (XSS) vulnerability in the Ajax handler in Drupal before\n7.39 allows remote attackers to inject arbitrary web script or HTML via\nvectors involving a whitelisted HTML element, possibly related to the \"a\" tag\n(CVE-2015-6665).\n","status":"published","published":"2015-08-27T20:49:46Z","modified":"2026-04-16T06:23:32.397625865Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"UBUNTU-CVE-2015-6660","description":"The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to \"file upload value callbacks.\"","status":"published","published":"2015-08-24T14:59:00Z","modified":"2025-09-08T16:43:27Z","updated_at":"2026-11-02T15:54:10.385269Z"}]}}