6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.002 Low
EPSS
Percentile
59.7%
Todo Filter module provides an input filter to display check-boxes that can be used as a task list.
Some paths were not protected against CSRF, meaning that an attacker could cause users to toggle tasks they did not intend to toggle by getting the user’s browser to make a request to a specially-crafted URL while the user was logged in.
Drupal core is not affected. If you do not use the contributed Todo Filter module, there is nothing you need to do.
Install the latest version:
Also see the Todo Filter project page.
twitter.com/drupalsecurity
www.drupal.org/contact
www.drupal.org/node/2403013
www.drupal.org/node/2403015
www.drupal.org/project/todo_filter
www.drupal.org/security-team
www.drupal.org/security-team/risk-levels
www.drupal.org/security/secure-configuration
www.drupal.org/user/1132616
www.drupal.org/user/2301194
www.drupal.org/writing-secure-code