VULNERABILITY INTELLIGENCE
CVE-2015-6660
CVSS score6.8 MEDIUM
EPSS probability1.33%
CISA KEVNot currently listed
Published2015-08-24
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:P/I:P/A:P
Description
The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."
Weakness classification
- CWE-352: Cross-Site Request Forgery (CSRF)