PT-2016-3760 · Ibm · Lotus Mashups+1

Published 2016-01-02 · Updated 2016-11-28 · CVE-2015-7407

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Mashup Center version 3.0.0.1

Description A cross-site request forgery (CSRF) issue in Lotus Mashups allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

Recommendations For IBM Mashup Center version 3.0.0.1, consider implementing anti-CSRF measures, such as token-based validation, to prevent unauthorized requests. As a temporary workaround, restrict access to sensitive operations that can insert XSS sequences until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2015-7407

Affected Products

Ibm Mashup Center

Lotus Mashups

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-7407 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21970299 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IT12268 · Vendor Advisory
• http://securityfocus.com/bid/78455 · Note