| Vulnerability Name: | CVE-2014-3015 (CCN-93026) | ||||||||
| Assigned: | 2014-05-25 | ||||||||
| Published: | 2014-05-25 | ||||||||
| Updated: | 2017-08-29 | ||||||||
| Summary: | Cross-site request forgery (CSRF) vulnerability in the Web player in IBM Sametime Proxy Server and Web Client 9.0 through 9.0.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. | ||||||||
| CVSS v3 Severity: | 2.6 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N)
| ||||||||
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P) 5.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:H/RL:OF/RC:C)
3.0 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N/E:H/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-352 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2014-3015 Source: CCN Type: IBM Security Bulletin 1673260 Security fixes for Sametime Proxy Server and Web Client Source: CONFIRM Type: Vendor Advisory http://www-01.ibm.com/support/docview.wss?uid=swg21673260 Source: CCN Type: BID-67598 IBM Sametime Proxy Server and Web Client CVE-2014-3015 Cross Site Request Forgery Vulnerability Source: XF Type: UNKNOWN ibm-sametime-cve20143015-csrf(93026) Source: XF Type: UNKNOWN ibm-sametime-cve20143015-csrf(93026) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||