The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Unspecified vulnerability in Drupal 5.x before 5.17 and 6.x before 6.11, as used in vbDrupal before 5.17.0, allows user-assisted remote attackers to obtain sensitive information by tricking victims into visiting the front page of the site with a crafted URL and causing form data to be sent to an attacker-controlled site, possibly related to multiple / (slash) characters that are not properly handled by includes/bootstrap.inc, as demonstrated using the search box. NOTE: this vulnerability can be leveraged to conduct cross-site request forgery (CSRF) attacks.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Drupal | — | Upgrade to Drupal version 6.11Upgrade to Drupal version 5.17 | Aug 2, 2017 | May 6, 2009 |
| Freebsd | — | Upgrade drupal5Upgrade drupal6 | Dec 10, 2025 | Apr 30, 2009 |
| Ubuntu | — | Upgrade drupal5Upgrade drupal6 | Nov 19, 2024 | May 6, 2009 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub