CVE-2015-7407

HIGH

IBM Mashup Center 3.0.0.1 - Cross-Site Request Forgery

Title source: llm

Description

Cross-site request forgery (CSRF) vulnerability in Lotus Mashups in IBM Mashup Center 3.0.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

References (3)

Core 3

Core References

Various Sources vendor-advisory x_refsource_aixapar

http://www-01.ibm.com/support/docview.wss?uid=swg1IT12268

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/78455

Vendor Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21970299

Scores

CVSS v3 8.8

EPSS 0.0063

EPSS Percentile 45.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-352

Status published

Products (1)

ibm/mashups_center 3.0.0.1

Published Jan 02, 2016

Tracked Since Feb 18, 2026