CVE-2015-3141

{"id": "CVE-2015-3141", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2015-05-20T19:59:02.450", "references": [{"url": "http://osvdb.org/show/osvdb/121847", "source": "cve@mitre.org"}, {"url": "http://packetstormsecurity.com/files/131844/Xeams-4.5-Build-5755-CSRF-Cross-Site-Scripting.html", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/74578", "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/36949/", "tags": ["Exploit"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of administrators for requests that create an (1) SMTP domain or a (2) user via a request to /FrontController; or conduct cross-site scripting (XSS) attacks via the (3) domainname parameter to /FrontController, when creating a new SMTP domain configuration; the (4) txtRecipient parameter to /FrontController, when creating a new forwarder; the (5) popFetchServer, (6) popFetchUser, or (7) popFetchRecipient parameter to /FrontController, when creating a new POP3 Fetcher account; or the (8) Smtp HELO domain in the Advanced Server Configuration."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de CSRF en Synametrics Technologies Xeams 4.5 Build 5755 y versiones ateriores permite a atacantes remotos secuestrar la autenticaci\u00f3n de administradores para peticiones que crean un (1) dominio SMTP o un (2) usuario a trav\u00e9s de una petici\u00f3n a /FrontController o llevar a cabo ataques de secuencias de comandos en sitios cruzados (XSS) a trav\u00e9s de (3) el par\u00e1metro domainname en /FrontController, cuando se crea una nueva configuraci\u00f3n de dominio SMTP; (4) el par\u00e1metro txtRecipient en /FrontController, cuando se crea un nuevo forwarder; el par\u00e1metro (5) popFetchServer, (6) popFetchUser o (7) popFetchRecipient en /FrontController, cuando se crea una nueva cuenta POP3 Fetcher o (8) el dominio Smtp HELO en el Advanced Server Configuration."}], "lastModified": "2016-12-03T03:08:30.403", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:synametrics:xeams:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C4197410-2B43-4FBF-95B3-C73610D47DD9", "versionEndIncluding": "4.5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}