What is CVE-2015-0116?

CVE-2015-0116 is a vulnerability in IBM Leads, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). Published 2015-06-28.

Is CVE-2015-0116 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in IBM Leads

CVE-2015-0116

IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 does not properly restrict the addition of links, which makes it easier for remote authenticated users to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.

EPSS: 0.008 (53.9th percentile) — read the EPSS interpretation.

Affected products

Ibm Leads — versions 7.1.0, 7.1.1, 7.5.0
N/a — versions n/a

Weakness classification (CWE)

CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

psirt@us.ibm.com (x_refsource_CONFIRM, Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2015-0116?: CVE-2015-0116 is a vulnerability in IBM Leads, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). Published 2015-06-28.
Is CVE-2015-0116 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.