PT-2015-6007 · Zoho · Zoho Netflow Analyzer

Akihito Mukai + 1 · Publicado 2015-06-09 · Atualizado 2016-12-31 · CVE-2015-2959

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zoho NetFlow Analyzer versions 10250 and earlier

Description The issue allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role, due to a lack of administrative authorization checks.

Recommendations For Zoho NetFlow Analyzer versions 10250 and earlier, update to a version later than 10250 to resolve the issue.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2015-2959

Produtos afetados

Zoho Netflow Analyzer

Referências · 6

• https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permissions-cross-site-scripting-cross-site-request-forgery-over-build-10250 · Aviso do Fabricante
• http://jvn.jp/en/jp/JVN25598413/index.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-2959 · Nota de Segurança
• http://securityfocus.com/bid/75065 · Nota
• http://securitytracker.com/id/1032516 · Nota
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000075 · Aviso do Fabricante