CVE-2015-2805

Cross-site request forgery (CSRF) vulnerability in sec/content/sec_asa_users_local_db_add.html in the management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, 6855, 6900, 10K, and 6860 with firmware 6.4.5.R02, 6.4.6.R01, 6.6.4.R01, 6.6.5.R02, 7.3.2.R01, 7.3.3.R01, 7.3.4.R01, and 8.1.1.R01 allows remote attackers to hijack the authentication of administrators for requests that create users via a crafted request.

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

3.05% chance of exploitation in the next 30 days, 87th percentile

Published

2015-06-16

Updated

2024-08-06

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/37261

References

• CVE Record
• NVD entry

Related

• CVE-2015-2803
• CVE-2015-2807
• CVE-2015-2798
• CVE-2015-2824
• CVE-2015-2797
• CVE-2015-2825