NVD

Id
24792  
Name
CVE-2015-2805  
Description
Cross-site request forgery (CSRF) vulnerability in sec/content/sec_asa_users_local_db_add.html in the management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, 6855, 6900, 10K, and 6860 with firmware 6.4.5.R02, 6.4.6.R01, 6.6.4.R01, 6.6.5.R02, 7.3.2.R01, 7.3.3.R01, 7.3.4.R01, and 8.1.1.R01 allows remote attackers to hijack the authentication of administrators for requests that create users via a crafted request.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-06-16  
Modified Date
2016-12-02  
Seq
2015-2805  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
130849 24792 CVE-2015-2805 http://packetstormsecurity.com/files/132236/Alcatel-Lucent-OmniSwitch-Web-Interface-Cross-Site-Request-Forgery.html  View
130850 24792 CVE-2015-2805 20150610 [RT-SA-2015-004] Alcatel-Lucent OmniSwitch Web Interface Cross-Site Request Forgery  View
130851 24792 CVE-2015-2805 20150610 [RT-SA-2015-004] Alcatel-Lucent OmniSwitch Web Interface Cross-Site Request Forgery  View
130852 24792 CVE-2015-2805 75121  View
130853 24792 CVE-2015-2805 1032544  View
130854 24792 CVE-2015-2805 37261  View
130855 24792 CVE-2015-2805 https://www.redteam-pentesting.de/advisories/rt-sa-2015-004  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
7845 JVNDB-2015-003165 複数の Alcatel-Lucent OmniSwitch のファームウェアの管理 Web インターフェースにおけるクロスサイトリクエストフォージェリの脆弱性 複数の Alcatel-Lucent OmniSwitch のファームウェアの管理 Web インターフェースの sec/content/sec_asa_users_local_db_add.html には、クロスサイトリクエストフォージェリの脆弱性が存在します。 CVE-2015-2805 80030 CVE-2015-2805 24792 6.8 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-003165.html 2015-06-10 2015-06-18 View