Vulnerability Details : CVE-2015-1485
Cross-site request forgery (CSRF) vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention (DLP) before 12.5.2 allows remote attackers to hijack the authentication of administrators.
Vulnerability category: Cross-site request forgery (CSRF)
Products affected by CVE-2015-1485
- cpe:2.3:a:symantec:data_loss_prevention:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-1485
0.12%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 47 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-1485
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
CWE ids for CVE-2015-1485
-
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-1485
-
http://www.securityfocus.com/bid/75289
Symantec Data Loss Prevention CVE-2015-1485 Cross Site Request Forgery VulnerabilityVendor Advisory
-
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150622_00
Symantec Data Loss Prevention Enforce Server Administration Console Cross-site Scripting, Cross-site
-
http://www.securitytracker.com/id/1032710
Symantec Data Loss Prevention Enforce Server Input Validation Flaws Permit Cross-Site Scripting and Cross-Site Request Forgery Attacks - SecurityTracker
Jump to