PT-2016-3760 · Ibm · Lotus Mashups+1

Publicado 2016-01-02 · Atualizado 2016-11-28 · CVE-2015-7407

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Mashup Center version 3.0.0.1

Description A cross-site request forgery (CSRF) issue in Lotus Mashups allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

Recommendations For IBM Mashup Center version 3.0.0.1, consider implementing anti-CSRF measures, such as token-based validation, to prevent unauthorized requests. As a temporary workaround, restrict access to sensitive operations that can insert XSS sequences until a patch is available.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2015-7407

Produtos afetados

Ibm Mashup Center

Lotus Mashups

Referências · 4

• http://securityfocus.com/bid/78455 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7407 · Nota de Segurança
• http://www-01.ibm.com/support/docview.wss?uid=swg21970299 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg1IT12268 · Aviso do Fabricante