Login Request a demo
Unscored severity · published Jun 9, 2015
CVE-2015-2959
Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or…
–
CVSS
3.3%
EPSS
No
On KEV
Description
Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MN
Manageengine Netflow Analyzer · Zohocorp
All versions, or not specified · source: NVD
Affected product
MN
Manageengine Netflow Analyzer
Zohocorp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-2959
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-2959
Vendor Advisory
http://jvn.jp/en/jp/JVN25598413/index.html
Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000075
www.securityfocus.com
http://www.securityfocus.com/bid/75065
www.securitytracker.com
http://www.securitytracker.com/id/1032516
Patch
https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permissions-cross-site-scripting-cross-site-request-forgery-over-build-10250
More from Manageengine Netflow Analyzer
9.8
CVE-2019-12196
A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the…
8.8
CVE-2022-38772
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow…
8.8
CVE-2022-37024
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003,…
8.6
CVE-2023-47211
A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258
8.2
CVE-2022-35404
ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine