CVE-2015-1485

Published: Jun 28, 2015Modified: May 6, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Cross-site request forgery (CSRF) vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention (DLP) before 12.5.2 allows remote attackers to hijack the authentication of administrators.

Affected (1)

Products: Symantec: Data Loss Prevention

Symantec

1 product

Data Loss Prevention

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Symantec Data Loss Prevention	Up to 12.5.1

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (6)

http://www.securityfocus.com/bid/75289

Source: secure@symantec.com

Vendor Advisory

http://www.securitytracker.com/id/1032710

Source: secure@symantec.com

http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150622_00

Source: secure@symantec.com

http://www.securityfocus.com/bid/75289

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securitytracker.com/id/1032710

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150622_00

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.