CSRF Vulnerability in CiviCRM Private Report Module for Drupal
CVE-2015-4391

Currently unrated

Key Information:

Vendor

Civicrm

Status
Civicrm Private Report
Vendor
CVE Published:
15 June 2015

What is CVE-2015-4391?

The CiviCRM private report module for Drupal is susceptible to a cross-site request forgery (CSRF) vulnerability. This security flaw enables remote attackers to potentially hijack the authentication of users, allowing malicious requests that could lead to the deletion of sensitive reports. Users of versions 6.x-1.x prior to 6.x-1.2 and 7.x-1.x prior to 7.x-1.3 are especially at risk, as they may not have sufficient safeguards against unauthorized actions performed in the context of a user session.

References

http://www.securityfocus.com/bid/74351
vdb-entryx_refsource_BID
http://www.openwall.com/lists/oss-security/2015/04/25/6
mailing-listx_refsource_MLIST
https://www.drupal.org/node/2467631
x_refsource_CONFIRM

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.