What is the CVSS score of CVE-2015-1454?

CVE-2015-1454 has a CVSS 2.0 base score of 7.1 (High). CVSS vector: AV:N/AC:M/Au:N/C:N/I:C/A:N. EPSS exploitation probability: 0.2%.

Proxyclient CVE-2015-1454

HIGH

Cryptographic Issues (CWE-310)

2015-02-02 cve@mitre.org

Information Disclosure Proxyclient Unified Agent

7.1

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:M/Au:N/C:N/I:C/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:N/I:C/A:N

Attack Vector

Network

Attack Complexity

Confidentiality

None

Integrity

Availability

None

Lifecycle Timeline

CVE Published

Feb 02, 2015 - 16:59 cve.org

HIGH 7.1

DescriptionCVE.org

Blue Coat ProxyClient before 3.3.3.3 and 3.4.x before 3.4.4.10 and Unified Agent before 4.1.3.151952 does not properly validate certain certificates, which allows man-in-the-middle attackers to spoof ProxySG Client Managers, and consequently modify configurations and execute arbitrary software updates, via a crafted certificate.

AnalysisAI

Blue Coat ProxyClient before 3.3.3.3 and 3.4.x before 3.4.4.10 and Unified Agent before 4.1.3.151952 does not properly validate certain certificates, which allows man-in-the-middle attackers to spoof. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-310. Blue Coat ProxyClient before 3.3.3.3 and 3.4.x before 3.4.4.10 and Unified Agent before 4.1.3.151952 does not properly validate certain certificates, which allows man-in-the-middle attackers to spoof ProxySG Client Managers, and consequently modify configurations and execute arbitrary software updates, via a crafted certificate. Affected products include: Bluecoat Proxyclient, Bluecoat Unified Agent. Version information: before 3.3.3.3.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.