CVE-2015-2959

Published: Jun 9, 2015Modified: May 6, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role.

Affected (1)

Products: Zohocorp: Manageengine Netflow Analyzer

Zohocorp

1 product

Manageengine Netflow Analyzer

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Netflow Analyzer	All versions

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (10)

http://jvn.jp/en/jp/JVN25598413/index.html

Source: vultures@jpcert.or.jp

Vendor Advisory

http://jvndb.jvn.jp/jvndb/JVNDB-2015-000075

Source: vultures@jpcert.or.jp

Vendor Advisory

http://www.securityfocus.com/bid/75065

Source: vultures@jpcert.or.jp

http://www.securitytracker.com/id/1032516

Source: vultures@jpcert.or.jp

https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permissions-cross-site-scripting-cross-site-request-forgery-over-build-10250

Source: vultures@jpcert.or.jp

PatchVendor Advisory

http://jvn.jp/en/jp/JVN25598413/index.html