CVE-2007-6752: Drupal

Medium severity, CVSS 6.8. EPSS: 3.7% chance of exploitation in the next 30 days.

Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI. NOTE: the vendor disputes the significance of this issue, by considering the "security benefit against platform complexity and performance impact" and concluding that a change to the logout behavior is not planned because "for most sites it is not worth the trade-off.

Affected products

• Drupal Drupal: up to and including 7.12; version 4.0 only; version 4.0.0 only; version 4.1.0 only; version 4.2.0_rc only; version 4.4 only; …

Published 2012-03-28. Last modified 2026-06-16.