Drupal Automated Logout Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Drupal Automated Logout module, specifically in versions prior to 1.7.0 and in the 2.0.0 series up to but not including 2.0.2. This vulnerability allows the logout route to be activated without user interaction, as the module does not adequately protect its routes from CSRF attacks.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery, where an attacker can trick a user into performing actions they did not intend to, such as logging out of a session.

Remediation

Users of the Automated Logout module should upgrade to version 1.7.0 or version 2.0.2. Instructions for downloading the latest version are available on the Drupal project page for Automated Logout.