Mailchimp - Critical - Cross Site Request Forgery - SA-CONTRIB-2023-025

2023-06-2800:00:00

Drupal Security Team

www.drupal.org

mailchimp

integration

csrf

vulnerability

oauth

authentication

attack

software

JSON

This module provides integration with Mailchimp, a popular email delivery service. A route related to OAuth authentication is not protected against a Cross Site Request Forgery attack.

Affected configurations

Vulners

Node

drupalmailchimpRange<2.2.2

VendorProductVersionCPE
drupalmailchimp*cpe:2.3:a:drupal:mailchimp:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
drupal	mailchimp	*	cpe:2.3:a:drupal:mailchimp::::::::

References

www.drupal.org/project/mailchimp/releases/2.2.2

www.drupal.org/user/17943

www.drupal.org/user/2210776

www.drupal.org/user/2799483

www.drupal.org/user/36762

www.drupal.org/user/369147

JSON