CVE Feed

    Dashboard / CVE / CVE-2015-2805

    CVE-2015-2805

    Cross-site request forgery (CSRF) vulnerability in sec/content/sec_asa_users_local_db_add.html in the management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, 6855, 6900, 10K, and 6860 with firmware 6.4.5.R02, 6.4.6.R01, 6.6.4.R01, 6.6.5.R02, 7.3.2.R01, 7.3.3.R01, 7.3.4.R01, and 8.1.1.R01 allows remote attackers to hijack the authentication of administrators for requests that create users via a crafted request.

    Published:Jun 16, 2015
    Last Modified:Apr 12, 2025
    EPS:Jun 16, 2015
    EPSS Score:0.01314
    CVSS Score:6.8

    Affected Products

    Vendor
    Alcatel-lucent
    Product
    Omniswitch 10k
    Vendor
    Alcatel-lucent
    Product
    Omniswitch 6250
    Vendor
    Alcatel-lucent
    Product
    Omniswitch 6400
    Vendor
    Alcatel-lucent
    Product
    Omniswitch 6450
    Vendor
    Alcatel-lucent
    Product
    Omniswitch 6850e
    Vendor
    Alcatel-lucent
    Product
    Omniswitch 6855
    Vendor
    Alcatel-lucent
    Product
    Omniswitch 6860
    Vendor
    Alcatel-lucent
    Product
    Omniswitch 6900
    Vendor
    Alcatel-lucent
    Product
    Omniswitch 9000e
    Vendor
    Alcatel-lucent
    Product
    Omniswitch Firmware

    Exploits

    http://packetstormsecurity.com/files/132236/Alcatel-Lucent-OmniSwitch-Web-Interface-Cross-Site-Request-Forgery.htmlhttp://seclists.org/fulldisclosure/2015/Jun/23https://www.exploit-db.com/exploits/37261/https://www.redteam-pentesting.de/advisories/rt-sa-2015-004http://packetstormsecurity.com/files/132236/Alcatel-Lucent-OmniSwitch-Web-Interface-Cross-Site-Request-Forgery.htmlhttp://seclists.org/fulldisclosure/2015/Jun/23https://www.exploit-db.com/exploits/37261/https://www.redteam-pentesting.de/advisories/rt-sa-2015-004https://www.exploit-db.com/exploits/37261

    References

    http://packetstormsecurity.com/files/132236/Alcatel-Lucent-OmniSwitch-Web-Interface-Cross-Site-Request-Forgery.html
    http://seclists.org/fulldisclosure/2015/Jun/23
    http://www.securityfocus.com/archive/1/535732/100/0/threaded
    http://www.securityfocus.com/bid/75121
    http://www.securitytracker.com/id/1032544
    https://www.exploit-db.com/exploits/37261/
    https://www.redteam-pentesting.de/advisories/rt-sa-2015-004
    http://packetstormsecurity.com/files/132236/Alcatel-Lucent-OmniSwitch-Web-Interface-Cross-Site-Request-Forgery.html
    http://seclists.org/fulldisclosure/2015/Jun/23
    http://www.securityfocus.com/archive/1/535732/100/0/threaded
    http://www.securityfocus.com/bid/75121
    http://www.securitytracker.com/id/1032544
    https://www.exploit-db.com/exploits/37261/
    https://www.redteam-pentesting.de/advisories/rt-sa-2015-004

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High