Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-7446

Cross-site request forgery (CSRF) vulnerability in IBM Flash System V9000 7.4 before 7.4.1.4, 7.5 before 7.5.1.3, and 7.6 before 7.6.0.4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

Published

2016-03-12T15:59:00.150

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 8.8 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

8.6

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-352
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System ibm flashsystem_v9000_firmware 7.4 Yes
Operating System ibm flashsystem_v9000_firmware 7.5 Yes
Operating System ibm flashsystem_v9000_firmware 7.6 Yes
Hardware ibm flashsystem_9846-ac2 - No
Hardware ibm flashsystem_9846-ae2 - No
Hardware ibm flashsystem_9848-ac2 - No
Hardware ibm flashsystem_9848-ae2 - No
References