Project Browser
Monthly
Cross-site request forgery in the Drupal Project Browser contributed module (affected ranges 0.0.0 through 2.0.2 and 2.1.0 through 2.1.4) lets an attacker riding an already-authenticated administrator's browser session submit forged requests against the site, with low confidentiality and integrity impact. Exploitation depends on luring a logged-in victim into interacting with attacker-controlled content while the session is live, so the vendor-assessed vector is AV:N/AC:H/PR:N/UI:R with a 4.2 base score, and EPSS is only 0.10% (1st percentile). There is no CISA KEV entry and no public exploit identified at time of analysis; vendor-released fixes exist in Project Browser 2.0.3 and 2.1.5, making this a low-to-moderate priority item to fold into the normal monthly patch cycle rather than an emergency.
Cross-site request forgery in the Drupal Project Browser contributed module (affected ranges 0.0.0 through 2.0.2 and 2.1.0 through 2.1.4) lets an attacker riding an already-authenticated administrator's browser session submit forged requests against the site, with low confidentiality and integrity impact. Exploitation depends on luring a logged-in victim into interacting with attacker-controlled content while the session is live, so the vendor-assessed vector is AV:N/AC:H/PR:N/UI:R with a 4.2 base score, and EPSS is only 0.10% (1st percentile). There is no CISA KEV entry and no public exploit identified at time of analysis; vendor-released fixes exist in Project Browser 2.0.3 and 2.1.5, making this a low-to-moderate priority item to fold into the normal monthly patch cycle rather than an emergency.