Unscored severity · published Jun 15, 2015
CVE-2015-4382
Multiple cross-site request forgery (CSRF) vulnerabilities in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the…
–
CVSS
0.6%
EPSS
No
On KEV
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the authentication of arbitrary users for requests that (1) create, (2) delete, or (3) alter invoices via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Invoice · Invoice Project
6.x-1.1; 7.x-1.x-dev · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-4382
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-4382
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/04/25/6
www.securityfocus.com
http://www.securityfocus.com/bid/74345
Patch
https://www.drupal.org/node/2459337
Patch
https://www.drupal.org/node/2474135
Patch
https://www.drupal.org/node/2474139
More from Invoice
–
CVE-2015-4381
Cross-site scripting (XSS) vulnerability in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "Administer…