Clickheat · Clickheat · CVE-2015-4659
**Name of the Vulnerable Software and Affected Versions**
ClickHeat versions 1.14 and earlier
**Description**
A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a config action to "index.php".
**Recommendations**
For ClickHeat versions 1.14 and earlier, update to a version later than 1.14 to resolve the issue.