CVE-2015-3375

2015-04-2116:59:33

CWE-352

[email protected]

web.nvd.nist.gov

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

AI Score

7.1

Confidence

Low

EPSS

0.002

Percentile

60.9%

JSON

Cross-site request forgery (CSRF) vulnerability in the Shibboleth Authentication module before 6.x-4.1 and 7.x-4.x before 7.x-4.1 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete user role matching rules via unspecified vectors.

Affected configurations

Nvd

Node

niifshibboleth_authenticationRange≤6.x-4.0drupal

niifshibboleth_authenticationMatch7.x-4.0drupal

VendorProductVersionCPE
niifshibboleth_authentication*cpe:2.3:a:niif:shibboleth_authentication:*:*:*:*:*:drupal:*:*
niifshibboleth_authentication7.x-4.0cpe:2.3:a:niif:shibboleth_authentication:7.x-4.0:*:*:*:*:drupal:*:*

Vendor	Product	Version	CPE
niif	shibboleth_authentication	*	cpe:2.3:a:niif:shibboleth_authentication::::::drupal::*
niif	shibboleth_authentication	7.x-4.0	cpe:2.3:a:niif:shibboleth_authentication:7.x-4.0:::::drupal::