CVE-2015-2959

Опубликовано: 09 июн. 2015

Источник: nvd

CVSS2: 7.5

EPSS Низкий

Описание

Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role.

Ссылки

http://jvn.jp/en/jp/JVN25598413/index.html
Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000075
Vendor Advisory
http://www.securityfocus.com/bid/75065
http://www.securitytracker.com/id/1032516
https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permissions-cross-site-scripting-cross-site-request-forgery-over-build-10250
Patch
Vendor Advisory
http://jvn.jp/en/jp/JVN25598413/index.html
Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000075
Vendor Advisory
http://www.securityfocus.com/bid/75065
http://www.securitytracker.com/id/1032516
https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permissions-cross-site-scripting-cross-site-request-forgery-over-build-10250
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:-:*:*:*:*:*:*:*

EPSS

Процентиль: 74%

0.00824

Низкий

7.5 High

CVSS2

Дефекты

CWE-284

Связанные уязвимости

GHSA-7wx4-2c6r-76ww

github

больше 3 лет назад