Searchblox CVE-2015-7919

CRITICAL

Permissions, Privileges, and Access Controls (CWE-264)

2015-12-21 ics-cert@hq.dhs.gov

Denial Of Service Privilege Escalation Searchblox

10.0

CVSS 3.0 · NVD

Share

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Dec 21, 2015 - 11:59 cve.org

CRITICAL 10.0

DescriptionCVE.org

SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently cause a denial of service (application crash), via unspecified vectors.

AnalysisAI

SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently cause a denial of service (application crash), via unspecified vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-264. SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently cause a denial of service (application crash), via unspecified vectors. Affected products include: Searchblox. Version information: before 8.3.1.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Searchblox

View all

CVE-2013-3597 MEDIUM This Month POC

servlet/CollectionListServlet in SearchBlox before 7.5 build 1 allows remote attackers to read usernames and passwords v

CVE-2018-11586 CRITICAL Act Now POC

XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to re

CVE-2018-11538 HIGH This Week POC

servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST param

CVE-2015-0970 HIGH This Week

Cross-site request forgery (CSRF) vulnerability in SearchBlox before 8.2 allows remote attackers to hijack the authentic

CVE-2015-3422 MEDIUM This Month POC

Cross-site scripting (XSS) vulnerability in SearchBlox before 8.2.1 allows remote attackers to inject arbitrary web scri

CVE-2015-0968 HIGH This Week

Unrestricted file upload vulnerability in admin/uploadImage.html in SearchBlox before 8.2 allows remote attackers to exe

CVE-2013-3590 MEDIUM This Month

Unrestricted file upload vulnerability in admin/uploadImage.html in SearchBlox before 7.5 build 1 allows remote attacker

CVE-2015-0969 MEDIUM This Month

SearchBlox before 8.2 allows remote attackers to obtain sensitive information via a pretty=true action to the _cluster/h

CVE-2013-3598 MEDIUM This Month

Directory traversal vulnerability in servlet/CreateTemplateServlet in SearchBlox before 7.5 build 1 allows remote attack

CVE-2015-0967 MEDIUM This Month

Multiple cross-site scripting (XSS) vulnerabilities in SearchBlox before 8.2 allow remote attackers to inject arbitrary

Same weakness CWE-264 – Permissions, Privileges, and Access Controls

View all

CVE-2013-0422 CRITICAL POC

CVE-2016-10372 CRITICAL POC

CVE-2014-9583 CRITICAL POC

CVE-2012-0297 CRITICAL POC

CVE-2015-7709 CRITICAL POC

CVE-2014-0514 CRITICAL POC

CVE-2013-6955 CRITICAL POC

CVE-2012-0299 CRITICAL POC

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2011-0611 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2012-0507 CRITICAL POC

CVE-2014-1761 HIGH POC

CVE-2015-5122 CRITICAL POC

CVE-2011-0609 HIGH POC

Share

CVE-2015-7919 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy