VulnerabilityModified

CVE-2015-7234

The OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology and OSF Import modules are enabled, allows user-assisted remote attackers to delete arbitrary files via unspecified vectors.

MEDIUM 4.0EPSS 2.00%

Does this matter?

Lower severity and a low EPSS score (2.00%). Track it; it rarely justifies an emergency change on its own.

Description

The OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology and OSF Import modules are enabled, allows user-assisted remote attackers to delete arbitrary files via unspecified vectors.

CVSS 2.0: 4.0 MEDIUMAV:N/AC:H/Au:N/C:N/I:P/A:P
EPSS: 2.00% probability · 80th percentile
CISA KEV: Not listed
Weakness: CWE-20
Affected: structured dynamics/open semantic framework
Source: cve@mitre.org

References

http://cgit.drupalcode.org/osf/commit/?id=35c6e61
https://www.drupal.org/node/2537120Patch
https://www.drupal.org/node/2537860Patch, Vendor Advisory
http://cgit.drupalcode.org/osf/commit/?id=35c6e61
https://www.drupal.org/node/2537120Patch
https://www.drupal.org/node/2537860Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.