Can someone add context to the subject issue? At first glance it appears to me this issue represents a fundamental shortfall in the forces encouraging secure coding in open source development. Is that the case and/or is this example common or a rare outlier?
I note that CVE-2007-6752 released on 28 March 2012 listed as an under review CSRF vulnerability has the status:
** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI. NOTE: the vendor disputes the significance of this issue, by considering the "security benefit against platform complexity and performance impact" and concluding that a change to the logout behavior is not planned because "for most sites it is not worth the trade-off."
In trying to get my head around the fact that the CVE dates to 2007 I found Red Hat carries a related bug report https://bugzilla.redhat.com/show_bug.cgi?id=807859 remarking that there is no upstream fix and “Eek. What a tempest…” That entry shares a link to five years of bug dialog within Drupal http://drupal.org/node/144538 that suggests the Eek comment is most appropriate.
Can someone enlighten me about the thinking behind the Drupal complexity trade-off response to an apparently acknowledged CSRF vulnerability? Is it just a simple case of “You can’t get there from here” limitation in a popular open source product? Does it matter or is this just a trivial issue I am misreading?