• Advisory ID: DRUPAL-SA-2007-033
  • Project: Feature module (third-party module)
  • Version: 4.7.x, 5.x
  • Date: 2007-December-05
  • Security risk: Not critical
  • Exploitable from: Remote
  • Vulnerability: Cross site request forgery


Feature is a contributed module that lets you organize and maintain a feature list by category.
The Drupal Forms API protects against cross site request forgeries (CSRF), where a malicous site can cause a user to unintentionally submit a form to a site where he is authenticated. The feature deletion form does not follow the standard Forms API submission model and is therefore not protected against this type of attack. A CSRF attack may result in the deletion of features.

To learn more about Cross Site Request Forgeries please read this article.

Versions affected

  • Feature 4.7.x-dev before December 6, 2007.
  • Feature 5.x-dev before December 6, 2007.


Install the latest version:

Reported by

Stéphane Corlosquet (scor)


The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.