CVE-2010-1547: chaos_tool_suite_project ctools Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2010-1547 is a medium (CVSS 6.8) Cross-Site Request Forgery (CSRF) vulnerability in chaos_tool_suite_project ctools. EPSS estimates a 0.67% chance of exploitation in the next 30 days, higher than 51.1% of scored vulnerabilities.

Timeline

1. 21-05-2010
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the Chaos Tool Suite (aka CTools) module 6.x before 6.x-1.4 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) enable a page via a q=admin/build/pages/nojs/enable/ value or (2) disable a page via a q=admin/build/pages/nojs/disable/ value.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.