Drupal Node Invite Module Cross-Site Request Forgery Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Node Invite is one of the modules that is similar to RSVP sending invitations via email. A cross-site request forgery vulnerability exists in the Drupal Node Invite module versions prio...

PT-2015-6192

Name of the Vulnerable Software and Affected Versions Drupal Node Invite module versions prior to 6.x-2.5 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destination parameter. This can be exploited to trick users into...

PT-2015-6191

Name of the Vulnerable Software and Affected Versions Drupal Node Invite module versions prior to 6.x-2.5 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of users with the node invite can manage invite permission for requests that re-enable...

PT-2015-6193

Name of the Vulnerable Software and Affected Versions Drupal Node Invite module versions prior to 6.x-2.5 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via a node title, which can lead to cross-site scripting XSS attacks. Recommendations For versio...