CVE-2015-5508

2015-08-1818:00:13

CWE-352

[email protected]

web.nvd.nist.gov

cve-2015-5508

cross-site request forgery

csrf

ncip provider

drupal toolkit

authentication hijacking

5.1 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

7.2 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

54.8%

JSON

Cross-site request forgery (CSRF) vulnerability in the XC NCIP Provider module in the eXtensible Catalog (XC) Drupal Toolkit allows remote attackers to hijack the authentication of users with the “administer ncip providers” permission for requests that alter NCIP providers via a crafted request.

Affected configurations

NVD

Node

the_extensible_catalog_drupal_toolkit_projectthe_extensible_catalog_drupal_toolkitMatch-drupal

CPENameOperatorVersion
the_extensible_catalog_drupal_toolkit_project:the_extensible_catalog_drupal_toolkitthe extensible catalog drupal toolkit project the extensible catalog drupal toolkiteq-

CPE	Name	Operator	Version
the_extensible_catalog_drupal_toolkit_project:the_extensible_catalog_drupal_toolkit	the extensible catalog drupal toolkit project the extensible catalog drupal toolkit	eq	-