What is the CVSS score of CVE-2015-6745?

CVE-2015-6745 has a CVSS 2.0 base score of 4.6 (Medium). CVSS vector: AV:L/AC:L/Au:N/C:P/I:P/A:P. EPSS exploitation probability: 0.1%.

Banking CVE-2015-6745

MEDIUM

Permissions, Privileges, and Access Controls (CWE-264)

2015-08-31 cve@mitre.org

Privilege Escalation Banking

4.6

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.6 MEDIUM

AV:L/AC:L/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:L/AC:L/Au:N/C:P/I:P/A:P

Attack Vector

Local

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Aug 31, 2015 - 14:59 cve.org

MEDIUM 4.6

DescriptionCVE.org

Basware Banking (Maksuliikenne) 8.90.07.X relies on the client to enforce account locking, which allows local users to bypass that security mechanism by deleting the entry from the locking table. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability type and different affected versions. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6744.

AnalysisAI

Basware Banking (Maksuliikenne) 8.90.07.X relies on the client to enforce account locking, which allows local users to bypass that security mechanism by deleting the entry from the locking table. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-264. Basware Banking (Maksuliikenne) 8.90.07.X relies on the client to enforce account locking, which allows local users to bypass that security mechanism by deleting the entry from the locking table. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability type and different affected versions. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6744. Affected products include: Basware Banking.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.