Unscored severity · published Nov 4, 2015
CVE-2015-6029
HP ArcSight Logger before 6.0 P2 does not limit attempts to authenticate to the SOAP interface, which makes it easier for remote attackers to obtain access via a brute-force…
–
CVSS
4.4%
EPSS
No
On KEV
Description
HP ArcSight Logger before 6.0 P2 does not limit attempts to authenticate to the SOAP interface, which makes it easier for remote attackers to obtain access via a brute-force approach.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.4% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AL
Arcsight Logger · HP
6.0.0.7307.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-6029
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-6029
Third Party Advisory
http://www.kb.cert.org/vuls/id/842252
www.securityfocus.com
http://www.securityfocus.com/bid/77128
Vendor Advisory
https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04863612
More from Arcsight Logger
9.8
CVE-2019-3479
Mitigates a potential remote code execution issue in ArcSight Logger versions prior to 6.7
8.8
CVE-2019-11655
Unrestricted file upload vulnerability in Micro Focus ArcSight Logger, version 6.7.0 and later
7.8
CVE-2019-3484
Mitigates a remote code execution issue in ArcSight Logger versions prior to 6.7
7.3
CVE-2015-6863
HPE ArcSight Logger before 6.1P1 allows remote attackers to execute arbitrary code via unspecified input to the (1) Intellicus or (2) client-certificate upload component
7.1
CVE-2019-3481
Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7