Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/10628?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10628?format=api", "vulnerability_id": "VCID-pnqb-afje-syez", "summary": "CSRF vulnerability\nThere's a flaw as HTTP requests to /admin/users do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a Cross-Site Request Forgery (CSRF / XSRF) attack causing the victim to creating administrative users.", "aliases": [ { "alias": "CVE-2015-1585" }, { "alias": "GHSA-wx7c-8j35-mpg8" }, { "alias": "OSV-118465" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51106?format=api", "purl": "pkg:gem/fat_free_crm@0.13.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-p8ek-y4fz-myeb" }, { "vulnerability": "VCID-sqvq-gfxk-nqfq" }, { "vulnerability": "VCID-u43k-mpnu-vfdr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/fat_free_crm@0.13.6" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/88607?format=api", "purl": "pkg:gem/fat_free_crm@0.11.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2z97-pz9d-j7a4" }, { "vulnerability": "VCID-6t92-45qk-k7fj" }, { "vulnerability": "VCID-8d95-wvef-wfcf" }, { "vulnerability": "VCID-awpb-h15g-8qdm" }, { "vulnerability": "VCID-j8xq-w8d5-tbhn" }, { "vulnerability": "VCID-p8ek-y4fz-myeb" }, { "vulnerability": "VCID-pnqb-afje-syez" }, { "vulnerability": "VCID-sqvq-gfxk-nqfq" }, { "vulnerability": "VCID-u43k-mpnu-vfdr" }, { "vulnerability": "VCID-ucwu-xvx1-dkdz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/fat_free_crm@0.11.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/88608?format=api", "purl": "pkg:gem/fat_free_crm@0.11.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2z97-pz9d-j7a4" }, { "vulnerability": "VCID-6t92-45qk-k7fj" }, { "vulnerability": "VCID-8d95-wvef-wfcf" }, { "vulnerability": "VCID-awpb-h15g-8qdm" }, { "vulnerability": "VCID-j8xq-w8d5-tbhn" }, { "vulnerability": "VCID-p8ek-y4fz-myeb" }, { "vulnerability": "VCID-pnqb-afje-syez" }, { "vulnerability": "VCID-sqvq-gfxk-nqfq" }, { "vulnerability": "VCID-u43k-mpnu-vfdr" }, { "vulnerability": "VCID-ucwu-xvx1-dkdz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/fat_free_crm@0.11.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/88609?format=api", "purl": "pkg:gem/fat_free_crm@0.11.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2z97-pz9d-j7a4" }, { "vulnerability": "VCID-6t92-45qk-k7fj" }, { "vulnerability": "VCID-8d95-wvef-wfcf" }, { "vulnerability": "VCID-awpb-h15g-8qdm" }, { "vulnerability": "VCID-j8xq-w8d5-tbhn" }, { "vulnerability": "VCID-p8ek-y4fz-myeb" }, { "vulnerability": "VCID-pnqb-afje-syez" }, { "vulnerability": "VCID-sqvq-gfxk-nqfq" }, { "vulnerability": "VCID-u43k-mpnu-vfdr" }, { "vulnerability": "VCID-ucwu-xvx1-dkdz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/fat_free_crm@0.11.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/88610?format=api", "purl": "pkg:gem/fat_free_crm@0.11.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2z97-pz9d-j7a4" }, { "vulnerability": "VCID-6t92-45qk-k7fj" }, { "vulnerability": "VCID-8d95-wvef-wfcf" }, { "vulnerability": "VCID-awpb-h15g-8qdm" }, { "vulnerability": "VCID-j8xq-w8d5-tbhn" }, { "vulnerability": "VCID-p8ek-y4fz-myeb" }, { "vulnerability": "VCID-pnqb-afje-syez" }, { "vulnerability": "VCID-sqvq-gfxk-nqfq" }, { "vulnerability": "VCID-u43k-mpnu-vfdr" }, { "vulnerability": "VCID-ucwu-xvx1-dkdz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/fat_free_crm@0.11.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/88611?format=api", "purl": "pkg:gem/fat_free_crm@0.11.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2z97-pz9d-j7a4" }, { "vulnerability": "VCID-6t92-45qk-k7fj" }, { "vulnerability": "VCID-8d95-wvef-wfcf" }, { "vulnerability": "VCID-awpb-h15g-8qdm" }, { "vulnerability": "VCID-j8xq-w8d5-tbhn" }, { "vulnerability": "VCID-p8ek-y4fz-myeb" }, { "vulnerability": "VCID-pnqb-afje-syez" }, { "vulnerability": "VCID-sqvq-gfxk-nqfq" }, { "vulnerability": "VCID-u43k-mpnu-vfdr" }, { "vulnerability": "VCID-ucwu-xvx1-dkdz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/fat_free_crm@0.11.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/88612?format=api", "purl": "pkg:gem/fat_free_crm@0.12.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2z97-pz9d-j7a4" }, { "vulnerability": "VCID-6t92-45qk-k7fj" }, { "vulnerability": "VCID-8d95-wvef-wfcf" }, { "vulnerability": "VCID-awpb-h15g-8qdm" }, { "vulnerability": "VCID-j8xq-w8d5-tbhn" }, { "vulnerability": "VCID-p8ek-y4fz-myeb" }, { "vulnerability": "VCID-pnqb-afje-syez" }, { "vulnerability": "VCID-sqvq-gfxk-nqfq" }, { "vulnerability": "VCID-u43k-mpnu-vfdr" }, { "vulnerability": "VCID-ucwu-xvx1-dkdz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/fat_free_crm@0.12.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/50594?format=api", "purl": "pkg:gem/fat_free_crm@0.12.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-awpb-h15g-8qdm" }, { "vulnerability": "VCID-p8ek-y4fz-myeb" }, { "vulnerability": "VCID-pnqb-afje-syez" }, { "vulnerability": "VCID-sqvq-gfxk-nqfq" }, { "vulnerability": "VCID-u43k-mpnu-vfdr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/fat_free_crm@0.12.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/90606?format=api", "purl": "pkg:gem/fat_free_crm@0.12.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-awpb-h15g-8qdm" }, { "vulnerability": "VCID-p8ek-y4fz-myeb" }, { "vulnerability": "VCID-pnqb-afje-syez" }, { "vulnerability": "VCID-sqvq-gfxk-nqfq" }, { "vulnerability": "VCID-u43k-mpnu-vfdr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/fat_free_crm@0.12.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/90607?format=api", "purl": "pkg:gem/fat_free_crm@0.12.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-awpb-h15g-8qdm" }, { "vulnerability": "VCID-p8ek-y4fz-myeb" }, { "vulnerability": "VCID-pnqb-afje-syez" }, { "vulnerability": "VCID-sqvq-gfxk-nqfq" }, { "vulnerability": "VCID-u43k-mpnu-vfdr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/fat_free_crm@0.12.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/50595?format=api", "purl": "pkg:gem/fat_free_crm@0.13.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-awpb-h15g-8qdm" }, { "vulnerability": "VCID-p8ek-y4fz-myeb" }, { "vulnerability": "VCID-pnqb-afje-syez" }, { "vulnerability": "VCID-sqvq-gfxk-nqfq" }, { "vulnerability": "VCID-u43k-mpnu-vfdr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/fat_free_crm@0.13.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/90608?format=api", "purl": "pkg:gem/fat_free_crm@0.13.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-awpb-h15g-8qdm" }, { "vulnerability": "VCID-p8ek-y4fz-myeb" }, { "vulnerability": "VCID-pnqb-afje-syez" }, { "vulnerability": "VCID-sqvq-gfxk-nqfq" }, { "vulnerability": "VCID-u43k-mpnu-vfdr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/fat_free_crm@0.13.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/90609?format=api", "purl": "pkg:gem/fat_free_crm@0.13.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-awpb-h15g-8qdm" }, { "vulnerability": "VCID-p8ek-y4fz-myeb" }, { "vulnerability": "VCID-pnqb-afje-syez" }, { "vulnerability": "VCID-sqvq-gfxk-nqfq" }, { "vulnerability": "VCID-u43k-mpnu-vfdr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/fat_free_crm@0.13.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/50886?format=api", "purl": "pkg:gem/fat_free_crm@0.13.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-p8ek-y4fz-myeb" }, { "vulnerability": "VCID-pnqb-afje-syez" }, { "vulnerability": "VCID-sqvq-gfxk-nqfq" }, { "vulnerability": "VCID-u43k-mpnu-vfdr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/fat_free_crm@0.13.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/91789?format=api", "purl": "pkg:gem/fat_free_crm@0.13.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-p8ek-y4fz-myeb" }, { "vulnerability": "VCID-pnqb-afje-syez" }, { "vulnerability": "VCID-sqvq-gfxk-nqfq" }, { "vulnerability": "VCID-u43k-mpnu-vfdr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/fat_free_crm@0.13.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/91790?format=api", "purl": "pkg:gem/fat_free_crm@0.13.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-p8ek-y4fz-myeb" }, { "vulnerability": "VCID-pnqb-afje-syez" }, { "vulnerability": "VCID-sqvq-gfxk-nqfq" }, { "vulnerability": "VCID-u43k-mpnu-vfdr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/fat_free_crm@0.13.5" } ], "references": [ { "reference_url": "http://osvdb.org/show/osvdb/118465", "reference_id": "", "reference_type": "", "scores": [], "url": "http://osvdb.org/show/osvdb/118465" }, { "reference_url": "http://packetstormsecurity.com/files/130410/Fat-Free-CRM-0.13.5-Cross-Site-Request-Forgery.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://packetstormsecurity.com/files/130410/Fat-Free-CRM-0.13.5-Cross-Site-Request-Forgery.html" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-1585", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00287", "scoring_system": "epss", "scoring_elements": "0.52382", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-1585" }, { "reference_url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/100925", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/100925" }, { "reference_url": "https://github.com/fatfreecrm/fat_free_crm", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/fatfreecrm/fat_free_crm" }, { "reference_url": "https://github.com/fatfreecrm/fat_free_crm/commit/86fd7f98c9583fd36384987282d1c086fdcecd7c", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/fatfreecrm/fat_free_crm/commit/86fd7f98c9583fd36384987282d1c086fdcecd7c" }, { "reference_url": "https://github.com/fatfreecrm/fat_free_crm/wiki/CSRF-Vulnerability-%28CVE-2015-1585%29", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/fatfreecrm/fat_free_crm/wiki/CSRF-Vulnerability-%28CVE-2015-1585%29" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fat_free_crm/CVE-2015-1585.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fat_free_crm/CVE-2015-1585.yml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1585", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1585" } ], "weaknesses": [ { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." }, { "cwe_id": 352, "name": "Cross-Site Request Forgery (CSRF)", "description": "The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." } ], "exploits": [], "severity_range_score": "4.0 - 6.9", "exploitability": "0.5", "weighted_severity": "0.0", "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-pnqb-afje-syez" }