Advanced Filesystem
Monthly
Cross-site request forgery in the Drupal Advanced Filesystem contrib module (versions 0.0.0 through 1.0.28) allows an attacker to induce a logged-in Drupal user into submitting a forged request that performs an Advanced Filesystem action with that user's privileges, yielding a limited integrity impact. The official CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), but the assessed vector corrects the user-interaction metric to UI:R, because a victim holding an authenticated session and sufficient permissions must be tricked into loading attacker-controlled content (a web page, ad, or email) for the forged request to fire; no attacker credentials are required, but the attack cannot succeed without that active session and victim interaction. This is a moderate-severity, low-priority issue in practice: EPSS is 0.10% (1st percentile), SSVC records Exploitation: none with Automatable: yes and Technical Impact: partial, and no public exploit has been identified at time of analysis.
Cross-site request forgery in the Drupal Advanced Filesystem contrib module (versions 0.0.0 through 1.0.28) allows an attacker to induce a logged-in Drupal user into submitting a forged request that performs an Advanced Filesystem action with that user's privileges, yielding a limited integrity impact. The official CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), but the assessed vector corrects the user-interaction metric to UI:R, because a victim holding an authenticated session and sufficient permissions must be tricked into loading attacker-controlled content (a web page, ad, or email) for the forged request to fire; no attacker credentials are required, but the attack cannot succeed without that active session and victim interaction. This is a moderate-severity, low-priority issue in practice: EPSS is 0.10% (1st percentile), SSVC records Exploitation: none with Automatable: yes and Technical Impact: partial, and no public exploit has been identified at time of analysis.