CVE-2015-2284 : userlogin.jsp in SolarWinds Firewall Security Manager (FSM) before 6.6.5 HotFix1 allows remote attackers to gain privile

userlogin.jsp in SolarWinds Firewall Security Manager (FSM) before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code via unspecified vectors, related to client session handling.

Published 2015-03-24 17:59:11

Updated 2015-03-25 21:13:12

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute code

Exploit prediction scoring system (EPSS) score for CVE-2015-2284

EPSS FAQ

97.42%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2015-2284

Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability

Disclosure Date: 2015-03-13

First seen: 2020-04-26

exploit/windows/http/solarwinds_fsm_userlogin

This module exploits multiple vulnerabilities found in Solarwinds Firewall Security Manager 6.6.5. The first vulnerability is an authentication bypass via the Change Advisor interface due to a user-controlled session.putValue API in userlogin.jsp, allowing the attacker to se

More information

CVSS scores for CVE-2015-2284

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2015-2284

CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-2284

http://www.zerodayinitiative.com/advisories/ZDI-15-107/

ZDI-15-107 | Zero Day Initiative
Patch

Products affected by CVE-2015-2284

Solarwinds » Firewall Security Manager
Versions up to, including, (<=) 6.6.5
cpe:2.3:a:solarwinds:firewall_security_manager:*:*:*:*:*:*:*:*
Matching versions