Launchpad.net

CVE 2012-0826

Cross-site request forgery (CSRF) vulnerability in the Aggregator module in Drupal 6.x before 6.23 and 7.x before 7.11 allows remote attackers to hijack the authentication of unspecified victims for requests that update feeds and possibly cause a denial of service (loss of updates due to rate limit) via unspecified vectors.

Related bugs and status

CVE-2012-0826 (Candidate) is related to these bugs:

Bug #929510: Lucid package of Drupal 6 contains critical security bugs

Summary				In	Importance	Status
	929510	Lucid package of Drupal 6 contains critical security bugs		drupal6 (Ubuntu)	Undecided	Triaged

Bug #1075466: SA-CORE-2012-001 - Drupal core multiple vulnerabilities

Summary				In	Importance	Status
	1075466	SA-CORE-2012-001 - Drupal core multiple vulnerabilities		drupal6 (Ubuntu)	Undecided	Fix Released
	1075466	SA-CORE-2012-001 - Drupal core multiple vulnerabilities		drupal6 (Debian)	Unknown	Fix Released

See the

CVE page on Mitre.org for more details.

References

MISC: http://www.debian.org/...
MISC: https://drupal.org/nod...