CVE-2015-5037

MEDIUM

IBM Connections < 3.0.1.1 - Authenticated Cross-Site Request Forgery

Title source: llm
STIX 2.1

Description

Cross-site request forgery (CSRF) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.

References (2)

Core 2
Core References
Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21971439
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1LO87020

Scores

CVSS v3 5.4
EPSS 0.0041
EPSS Percentile 32.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Details

CWE
CWE-352
Status published
Products (4)
ibm/connections 4.0
ibm/connections 4.5
ibm/connections 5.0
ibm/connections < 3.0.1.1
Published Jan 03, 2016
Tracked Since Feb 18, 2026