CVE-2009-2572: Lullabot Fivestar Module For Drupal

Medium severity, CVSS 6.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Cross-site request forgery (CSRF) vulnerability in the Fivestar module 5.x-1.x before 5.x-1.14 and 6.x-1.x before 6.x-1.14, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users for requests that cast votes.

Affected products

• Lullabot Fivestar Module For Drupal: version 5.x-1.9 only; version 5.x-1.10 only; version 5.x-1.11 only; version 5.x-1.12 only; version 5.x-1.13 only; version 6.x-1.11 only; …

Published 2009-07-22. Last modified 2026-06-16.