| Package | Affected versions | Patched versions |
|---|---|---|
| drupal | ≥ 5.0, < 5.3 | 5.3 |
Drupal 5.x before 5.3 does not apply its Drupal Forms API protection against the user deletion form, which allows remote attackers to delete users via a cross-site request forgery (CSRF) attack.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free