CSRF in Alcatel-Lucent Omniswitch 10k
CVE-2015-2805
Cross-site request forgery (CSRF) vulnerability in sec/content/sec_asa_users_local_db_add.html in the management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, 6855, 6900, 10K, and 6860 with firmware 6.4.5.R02, 6.4.6.R01, 6.6.4.R01, 6.6.5.R02, 7.3.2.R01, 7.3.3.R01, 7.3.4.R01, and 8.1.1.R01 allows remote attackers to hijack the authentication of administrators for requests that create users via a crafted request.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.030 (86.2th percentile) — read the EPSS interpretation.
Affected products
- Alcatel-lucent Omniswitch_10k
- Alcatel-lucent Omniswitch_6250
- Alcatel-lucent Omniswitch_6400
- Alcatel-lucent Omniswitch_6450
- Alcatel-lucent Omniswitch_6850e
- Alcatel-lucent Omniswitch_6855
- Alcatel-lucent Omniswitch_6860
- Alcatel-lucent Omniswitch_6900
- Alcatel-lucent Omniswitch_9000e
- Alcatel-lucent Omniswitch_firmware
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (mailing-list, Exploit, x_refsource_FULLDISC)
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (Exploit, exploit, x_refsource_EXPLOIT-DB)
- cve@mitre.org (Exploit, x_refsource_MISC)
Frequently asked questions
- What is CVE-2015-2805?
- CVE-2015-2805 is a vulnerability in Alcatel-Lucent Omniswitch 10k, classified under Cross-Site Request Forgery (CSRF). Published 2015-06-16.
- Is CVE-2015-2805 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.