PT-2015-6573

Name of the Vulnerable Software and Affected Versions CiviCRM versions 6.x-1.x before 6.x-1.2 CiviCRM versions 7.x-1.x before 7.x-1.3 Description A cross-site request forgery CSRF issue exists in the private report module, allowing remote attackers to hijack user authentication for requests that...

CVE-2015-4391: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the CiviCRM private report module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of users for requests that delete reports via unspecified vectors...

Drupal CiviCRM private report module cross-site request forgery vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site request forgery vulnerability exists in Drupal CiviCRM private report, which allows remote attackers to construct malicious URIs, trick users into parsing them, and can target user contexts to perform...