Unscored severity · published Jun 15, 2015
CVE-2015-4352
Cross-site request forgery (CSRF) vulnerability in the Spider Video Player module for Drupal allows remote attackers to hijack the authentication of administrators for requests…
–
CVSS
0.6%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in the Spider Video Player module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete videos via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
Web-dorado Spider Video Player · Web-dorado
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-4352
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-4352
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/04/25/6
www.securityfocus.com
http://www.securityfocus.com/bid/72817
Vendor Advisory
https://www.drupal.org/node/2437981
More from Web-dorado Spider Video Player
–
CVE-2015-4351
The Spider Video Player module for Drupal allows remote authenticated users with the "access Spider Video Player administration" permission to delete arbitrary files via a crafted…
–
CVE-2014-8584
Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) plugin before 1.5.2 for WordPress allows remote attackers to inject…