Vulnerability Details : CVE-2014-3015
Cross-site request forgery (CSRF) vulnerability in the Web player in IBM Sametime Proxy Server and Web Client 9.0 through 9.0.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Vulnerability category: Cross site scripting (XSS)Cross-site request forgery (CSRF)
Products affected by CVE-2014-3015
- cpe:2.3:a:ibm:sametime_proxy_server_and_web_client:9.0.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:sametime_proxy_server_and_web_client:9.0.0.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-3015
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 39 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-3015
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
CWE ids for CVE-2014-3015
-
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-3015
-
http://www-01.ibm.com/support/docview.wss?uid=swg21673260
IBM Security Bulletin: Security fixes for Sametime Proxy Server and Web ClientVendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/93026
IBM Lotus Sametime Web player cross-site request forgery CVE-2014-3015 Vulnerability Report
Jump to