Currency
Monthly
Cross-site request forgery in the Drupal Currency contributed module (versions before 3.5.0) lets an attacker trigger state-changing requests through a victim's browser session, because the module fails to validate a per-request anti-CSRF token on that operation. As reflected in the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), exploitation requires tricking a logged-in Drupal user - typically an administrator with Currency-management permissions - into visiting attacker-controlled content or clicking a crafted link while their session is active, and the resulting impact is limited to a low-integrity modification with no data disclosure or service disruption. No public exploit code has been identified and the issue is not in CISA KEV; EPSS is negligible at 0.13% (2nd percentile), making this a genuinely low-priority issue despite being a network-vector flaw, and sites already running Currency 3.5.0 or later are unaffected.
Cross-site request forgery in the Drupal Currency contributed module (versions before 3.5.0) lets an attacker trigger state-changing requests through a victim's browser session, because the module fails to validate a per-request anti-CSRF token on that operation. As reflected in the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), exploitation requires tricking a logged-in Drupal user - typically an administrator with Currency-management permissions - into visiting attacker-controlled content or clicking a crafted link while their session is active, and the resulting impact is limited to a low-integrity modification with no data disclosure or service disruption. No public exploit code has been identified and the issue is not in CISA KEV; EPSS is negligible at 0.13% (2nd percentile), making this a genuinely low-priority issue despite being a network-vector flaw, and sites already running Currency 3.5.0 or later are unaffected.