What is the CVSS score of CVE-2015-2917?

CVE-2015-2917 has a CVSS 2.0 base score of 4.3 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. EPSS exploitation probability: 0.9%.

Is there a patch available for CVE-2015-2917?

Yes, a patch is available for CVE-2015-2917. Update the affected software to the latest version immediately.

Almond Firmware CVE-2015-2917

MEDIUM

Improper Input Validation (CWE-20)

2015-09-21 cret@cert.org

Information Disclosure Almond Firmware Almond 2015 Firmware

4.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:N/I:P/A:N

Attack Vector

Network

Attack Complexity

Confidentiality

None

Integrity

Availability

None

Lifecycle Timeline

CVE Published

Sep 21, 2015 - 10:59 cve.org

MEDIUM 4.3

DescriptionCVE.org

Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally omit the X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site that contains a (1) FRAME, (2) IFRAME, or (3) OBJECT element.

AnalysisAI

Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally omit the X-Frame-Options HTTP header, which makes it easier. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.

Technical ContextAI

This vulnerability is classified under CWE-20. Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally omit the X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site that contains a (1) FRAME, (2) IFRAME, or (3) OBJECT element. Affected products include: Securifi Almond Firmware, Securifi Almond-2015 Firmware.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.