CVEvulnerability
CVE-2015-2959
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2015-06-09
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-284
Description
Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role.
Affected configurations
• zohocorp manageengine netflow analyzer
Related
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- http://jvn.jp/en/jp/JVN25598413/index.html Vendor Advisory
- http://jvndb.jvn.jp/jvndb/JVNDB-2015-000075 Vendor Advisory
- http://www.securityfocus.com/bid/75065 www.securityfocus.com
- http://www.securitytracker.com/id/1032516 www.securitytracker.com
- https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permissions-cross-site-scripting-cross-site-request-forgery-over-build-10250 Patch, Vendor Advisory
- http://jvn.jp/en/jp/JVN25598413/index.html Vendor Advisory
- http://jvndb.jvn.jp/jvndb/JVNDB-2015-000075 Vendor Advisory
- http://www.securityfocus.com/bid/75065 www.securityfocus.com
- http://www.securitytracker.com/id/1032516 www.securitytracker.com
- https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permissions-cross-site-scripting-cross-site-request-forgery-over-build-10250 Patch, Vendor Advisory