Login Request a demo
Critical severity · published Feb 21, 2016
CVE-2015-7425
The Data Protection component in the VMware vSphere GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual…
10.0
CVSS
3.9%
EPSS
No
On KEV
Description
The Data Protection component in the VMware vSphere GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 6.3 before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.4 and Tivoli Storage FlashCopy Manager for VMware (aka Spectrum Protect Snapshot) 3.1 before 3.1.1.3, 3.2 before 3.2.0.6, and 4.1 before 4.1.4 allows remote attackers to obtain administrative privileges via a crafted URL that triggers back-end function execution.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TS
Tivoli Storage Flashcopy Manager For Vmware · Ibm
3.1; 3.1.1; 3.2; 6.3; 6.4; 6.4.2; +1 more · source: NVD
TS
Tivoli Storage Manager For Virtual Environments Data Protection For Vmware · Ibm
4.1.0; 4.1.1; 4.1.2; 4.1.3; 6.3.1; 6.3.2; +5 more · source: NVD
Affected product
TS
Tivoli Storage Flashcopy Manager For Vmware
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7425
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-7425
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21973086
www.securityfocus.com
http://www.securityfocus.com/bid/79545
More from Tivoli Storage Flashcopy Manager For Vmware
8.8
CVE-2016-6033
IBM Tivoli Storage Manager for Virtual Environments 7.1 (VMware) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized…