CVE-2015-3349: Htaccess Project Htaccess

Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Multiple cross-site request forgery (CSRF) vulnerabilities in the Htaccess module before 7.x-2.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) deploy or (2) delete an .htaccess file via unspecified vectors.

Affected products

• Htaccess Project Htaccess: up to and including 7.x-2.2

Published 2015-04-21. Last modified 2026-06-17.