CVE-2007-6752

Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI. NOTE: the vendor disputes the significance of this issue, by considering the "security benefit against platform complexity and performance impact" and concluding that a change to the logout behavior is not planned because "for most sites it is not worth the trade-off.

• CWE-352

• https://drupal.org/node/144538Vendor Advisory
• https://groups.drupal.org/node/216314Vendor Advisory
• https://ivanobinetti.blogspot.it/2012/03/drupal-cms-712-latest-stable-release.html
• https://packetstormsecurity.org/files/110404/drupal712-xsrf.txtExploit
• https://www.exploit-db.com/exploits/18564/Exploit
• https://drupal.org/node/144538Vendor Advisory
• https://groups.drupal.org/node/216314Vendor Advisory
• https://ivanobinetti.blogspot.it/2012/03/drupal-cms-712-latest-stable-release.html
• https://packetstormsecurity.org/files/110404/drupal712-xsrf.txtExploit
• https://www.exploit-db.com/exploits/18564/Exploit

Published

Mar 28, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-6746telepathy-idle before 0.1.15 does not verify (1) that the is…
• CVE-2007-6747Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2007-6748Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2007-6749Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2007-6750The Apache HTTP Server 1.x and 2.x allows remote attackers t…
• CVE-2007-6751Cross-site scripting (XSS) vulnerability in the MailForm plu…
• CVE-2007-6753Untrusted search path vulnerability in Shell32.dll in Micros…
• CVE-2007-6754The ipalloc function in libc/stdlib/malloc.c in jemalloc in …
• CVE-2007-6755The NIST SP 800-90A default statement of the Dual Elliptic C…
• CVE-2007-6756ZOLL Defibrillator / Monitor M Series, E Series, and R Serie…
• CVE-2007-6757GE Healthcare Centricity DMS 4.2, 4.1, and 4.0 has a passwor…
• CVE-2007-6758Server-side request forgery (SSRF) vulnerability in feed-pro…7.5