[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxhmDBxJ9vRwUVEGmMfquT8H2doELsWpU2yKBeK_XMvA":3,"g5a-risk:CVE-2015-4391":139},{"success":4,"data":5,"meta":137},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":28,"epssPercentile":15,"epssTimeSeries":29,"severity":30,"affectedProducts":31,"affectedProductsCount":49,"references":50,"referencesCount":81,"weaknesses":82,"weaknessesCount":91,"isActivelyExploited":92,"cisaInfo":15,"otxData":15,"relatedBlogPosts":93,"seoMetadata":94,"configurations":119,"relatedVendorCves":135,"notableEvents":136},"CVE-2015-4391","What is CVE-2015-4391?","Cross-site request forgery (CSRF) vulnerability in the CiviCRM private report module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of users for requests that delete reports via unspecified vectors.","Cross-site request forgery (CSRF) vulnerability in the CiviCRM private report module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remo...","2015-06-15T14:59:46.403","2025-04-12T10:46:40.837",6.8,"AV:N\u002FAC:M\u002FAu:N\u002FC:P\u002FI:P\u002FA:P",{"CVSSMetricV31":15,"CVSSMetricV30":15,"CVSSMetricV2":16,"CVSSMetricV40":15},null,[17],{"Source":18,"Type":19,"CVSSData":20,"BaseSeverity":23,"ExploitabilityScore":26,"ImpactScore":27,"ACInsufInfo":15,"ObtainAllPrivilege":15,"ObtainUserPrivilege":15,"ObtainOtherPrivilege":15,"UserInteractionRequired":4},"nvd@nist.gov","Primary",{"Version":21,"VectorString":13,"AccessVector":22,"AccessComplexity":23,"Authentication":24,"ConfidentialityImpact":25,"IntegrityImpact":25,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":15,"Exploitability":15,"RemediationLevel":15,"ReportConfidence":15,"TemporalScore":15,"CollateralDamagePotential":15,"TargetDistribution":15,"ConfidentialityRequirement":15,"IntegrityRequirement":15,"AvailabilityRequirement":15,"EnvironmentalScore":15},"2.0","NETWORK","MEDIUM","NONE","PARTIAL",8.6,6.4,0.00643,[28,28,28,28,28,28,28],"Medium",[32,37,40,43,46],{"vendor":33,"product":34,"version":35,"criteria":36,"vulnerable":4},"civicrm","civicrm_private_report","6.x-1.0","cpe:2.3:a:civicrm:civicrm_private_report:6.x-1.0:*:*:*:*:drupal:*:*",{"vendor":33,"product":34,"version":38,"criteria":39,"vulnerable":4},"6.x-1.1","cpe:2.3:a:civicrm:civicrm_private_report:6.x-1.1:*:*:*:*:drupal:*:*",{"vendor":33,"product":34,"version":41,"criteria":42,"vulnerable":4},"7.x-1.0","cpe:2.3:a:civicrm:civicrm_private_report:7.x-1.0:*:*:*:*:drupal:*:*",{"vendor":33,"product":34,"version":44,"criteria":45,"vulnerable":4},"7.x-1.1","cpe:2.3:a:civicrm:civicrm_private_report:7.x-1.1:*:*:*:*:drupal:*:*",{"vendor":33,"product":34,"version":47,"criteria":48,"vulnerable":4},"7.x-1.2","cpe:2.3:a:civicrm:civicrm_private_report:7.x-1.2:*:*:*:*:drupal:*:*",5,[51,55,59,64,67,71,73,75,77,79],{"url":52,"source":53,"tags":54},"http:\u002F\u002Fwww.openwall.com\u002Flists\u002Foss-security\u002F2015\u002F04\u002F25\u002F6","Openwall",[],{"url":56,"source":57,"tags":58},"http:\u002F\u002Fwww.securityfocus.com\u002Fbid\u002F74351","Securityfocus",[],{"url":60,"source":61,"tags":62},"https:\u002F\u002Fwww.drupal.org\u002Fnode\u002F2467631","Drupal",[63],"Patch",{"url":65,"source":61,"tags":66},"https:\u002F\u002Fwww.drupal.org\u002Fnode\u002F2467635",[63],{"url":68,"source":61,"tags":69},"https:\u002F\u002Fwww.drupal.org\u002Fnode\u002F2467697",[63,70],"Vendor Advisory",{"url":52,"source":53,"tags":72},[],{"url":56,"source":57,"tags":74},[],{"url":60,"source":61,"tags":76},[63],{"url":65,"source":61,"tags":78},[63],{"url":68,"source":61,"tags":80},[63,70],10,[83],{"id":84,"name":85,"description":86,"extendedDescription":87,"status":88,"abstraction":89,"structure":90},"CWE-352","Cross-Site Request Forgery (CSRF)","The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.","When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.","Stable","Compound","Composite",1,false,[],{"title":95,"metaDescription":96,"keywords":97,"canonicalUrl":98,"structuredData":99},"What is CVE-2015-4391? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2015-4391, a medium severity cyber security vulnerability from 2015. Cross-site request forgery (CSRF) vulnerability in the Civ...","CVE-2015-4391, CVE-2015-4391 vulnerability, CVE-2015-4391 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2015, CVSS score, exploit, patch, remediation, civicrm security, civicrm_private_report vulnerability","\u002Fwhat-is\u002Fcve-2015-4391",{"@context":100,"@type":101,"headline":95,"description":96,"datePublished":10,"dateModified":11,"author":102,"publisher":106,"about":110,"mainEntityOfPage":114,"articleSection":117,"keywords":118},"https:\u002F\u002Fschema.org","TechArticle",{"@type":103,"name":104,"url":105},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":103,"name":104,"url":105,"logo":107},{"@type":108,"url":109},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":111,"name":6,"description":112,"additionalType":113},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":115,"@id":116},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2015-4391","Cybersecurity","CVE-2015-4391, CVE-2015-4391 vulnerability, CVE-2015-4391 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[120],{"Operator":15,"Negate":15,"Nodes":121},[122],{"Operator":123,"Negate":15,"CPEMatch":124},"OR",[125,127,129,131,133],{"Vulnerable":4,"Criteria":36,"MatchCriteriaID":126,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":15,"VersionEndIncluding":15},"C2FDB2B9-2C30-4CE1-AAE2-22DEF605B7DD",{"Vulnerable":4,"Criteria":39,"MatchCriteriaID":128,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":15,"VersionEndIncluding":15},"11028F6B-FEFA-4D1B-8394-7543915DC3B8",{"Vulnerable":4,"Criteria":42,"MatchCriteriaID":130,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":15,"VersionEndIncluding":15},"9D3EE281-99B9-4070-9673-302105F9016F",{"Vulnerable":4,"Criteria":45,"MatchCriteriaID":132,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":15,"VersionEndIncluding":15},"8582B3EE-FB66-48F7-8079-374DFE17D4D6",{"Vulnerable":4,"Criteria":48,"MatchCriteriaID":134,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":15,"VersionEndIncluding":15},"A833CD03-235B-4153-A4F1-D7A6B54730D6",[],[],{"lastModified":11,"cacheTime":138,"version":21},1792372317367,{"score":140,"band":141,"action":142,"scoredAt":143},21,"Low","Monitor","2026-10-17T07:38:38.400695+00:00"]