En bref
- CVE-2026-4393 est une vulnérabilité MOYENNE (CVSS 4.3) touchant drupal/autologout, automated logout (ajk).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.11%, plus élevée que 1.4% des vulnérabilités.
- Correctif : mettre à jour vers 2.0.2, 1.7.0, 8.x-1.7 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| drupal/autologout Packagist:https://packages.drupal.org/8 | ≥ 2.0.0, < 2.0.2< 1.7.0
| 2.0.21.7.0
|
| automated logout | ≥ 2.0.0, < 2.0.2< 8.x-1.7
| 2.0.28.x-1.7
|
Description
This module provides a site administrator the ability to log users out after a specified time of inactivity.
The module doesn't sufficiently protect its routes from cross-site request forgery (CSRF), allowing the logout route to be triggered without user interaction.
NVD description
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Automated Logout allows Cross Site Request Forgery.This issue affects Automated Logout: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free