PT-2015-6584 · Zoho · Zoho Netflow Analyzer

Published 2015-06-09 · Updated 2016-12-31 · CVE-2015-4418

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Zoho NetFlow Analyzer versions prior to build 10250

Description The issue makes it easier for remote attackers to obtain access by leveraging an unattended workstation, as the password field lacks an off autocomplete attribute.

Recommendations For versions prior to build 10250, update to a version that includes the off autocomplete attribute for the password field to prevent unauthorized access.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2015-4418

Affected Products

Zoho Netflow Analyzer

References · 4

• https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permissions-cross-site-scripting-cross-site-request-forgery-over-build-10250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-4418 · Security Note
• http://securityfocus.com/bid/75068 · Note
• http://securitytracker.com/id/1032516 · Note