6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.967 High
EPSS
Percentile
99.7%
The Batch Jobs project is a scalable way to execute a list of tasks.
Links that take actions on batch jobs are not protected from Cross Site Request Forgery (CSRF). A malicious individual could cause a user that has permission to access a particular batch job (or an administrator) to delete the record of that batch job or possibly execute a task by getting the user’s browser to make a request to a specially-crafted URL while the user is logged in.
This vulnerability only exists when batch job data exists - i.e. during the short period it is running or if it is retained (not deleted after completion of the batch job).
Drupal core is not affected. If you do not use the contributed Batch Jobs module,
there is nothing you need to do.
Make sure that all batch jobs are deleted or install the latest version:
Also see the Batch Jobs project page.