Vulnerability Details : CVE-2015-6538
The login page in Epiphany Cardio Server 3.3, 4.0, and 4.1 mishandles authentication requests, which allows remote attackers to conduct LDAP injection attacks, and consequently bypass intended access restrictions, via a crafted URL.
Exploit prediction scoring system (EPSS) score for CVE-2015-6538
Probability of exploitation activity in the next 30 days: 0.32%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 67 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2015-6538
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
[email protected] |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
[email protected] |
References for CVE-2015-6538
-
http://www.epiphanyhealthdata.com/blog/certresponse
Vendor Advisory
-
https://www.kb.cert.org/vuls/id/630239
Third Party Advisory;US Government Resource
Products affected by CVE-2015-6538
- cpe:2.3:a:ephiphanyheathdata:cardio_server:4.1:*:*:*:*:*:*:*
- cpe:2.3:a:ephiphanyheathdata:cardio_server:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:ephiphanyheathdata:cardio_server:3.3:*:*:*:*:*:*:*