Description
** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI. NOTE: the vendor disputes the significance of this issue, by considering the "security benefit against platform complexity and performance impact" and concluding that a change to the logout behavior is not planned because "for most sites it is not worth the trade-off."
Remediation
References
Related Vulnerabilities
WordPress Plugin WordPress Photo Gallery by Gallery Bank Unspecified Vulnerability (3.1.26)
osCommerce Other Vulnerability (CVE-2005-1951)
PHP Other Vulnerability (CVE-2007-1379)
Magento CVE-2020-3718 Vulnerability (CVE-2020-3718)
Ruby on Rails Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-0449)