CVE-2015-4364

Multiple cross-site request forgery (CSRF) vulnerabilities in includes/campaignmonitor_lists.admin.inc in the Campaign Monitor module 7.x-1.0 for Drupal allow…

published June 15, 2015

CVSS
—
EPSS
1%
Percentile
49.9
In the wild
Unconfirmed
What it is

Multiple cross-site request forgery (CSRF) vulnerabilities in includes/campaignmonitor_lists.admin.inc in the Campaign Monitor module 7.x-1.0 for Drupal allow remote attackers to hijack the authentication of users for requests that (1) enable list subscriptions via a request to admin/config/services/campaignmonitor/lists/%/enable or (2) disable list subscriptions via a request to admin/config/services/campaignmonitor/lists/%/disable. NOTE: this refers to an issue in an independently developed Drupal module, and NOT an issue in the Campaign Monitor software itself (described on the campaignmonitor.com web site).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00643 · 49.9th percentile
Published
2015-06-15T14:00Z
EPSS history
Timeline
  • 15 JUN 14:00Z
    Multiple cross-site request forgery (CSRF) vulnerabilities in includes/campaignmonitor_lists.admin.inc in the Campaign Monitor module 7.x-1.0 for Drupal allow…
    cvelistv5