Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2015-2156
HistoryOct 18, 2017 - 3:29 p.m.

CVE-2015-2156

2017-10-1815:29:00
CWE-20
[email protected]
web.nvd.nist.gov
71
cve-2015-2156
netty
play framework
security vulnerability
remote attackers
cookie validation
nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.3 High

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.006 Low

EPSS

Percentile

77.8%

JSON

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.

Affected configurations

NVD
Node
nettynettyRange≤3.9.7
OR
nettynettyMatch3.10.0
OR
nettynettyMatch3.10.1
OR
nettynettyMatch3.10.2
OR
nettynettyMatch4.0.0
OR
nettynettyMatch4.0.1
OR
nettynettyMatch4.0.2
OR
nettynettyMatch4.0.3
OR
nettynettyMatch4.0.4
OR
nettynettyMatch4.0.5
OR
nettynettyMatch4.0.6
OR
nettynettyMatch4.0.7
OR
nettynettyMatch4.0.8
OR
nettynettyMatch4.0.9
OR
nettynettyMatch4.0.10
OR
nettynettyMatch4.0.11
OR
nettynettyMatch4.0.12
OR
nettynettyMatch4.0.13
OR
nettynettyMatch4.0.14
OR
nettynettyMatch4.0.15
OR
nettynettyMatch4.0.16
OR
nettynettyMatch4.0.17
OR
nettynettyMatch4.0.18
OR
nettynettyMatch4.0.19
OR
nettynettyMatch4.0.20
OR
nettynettyMatch4.0.21
OR
nettynettyMatch4.0.22
OR
nettynettyMatch4.0.23
OR
nettynettyMatch4.0.24
OR
nettynettyMatch4.0.25
OR
nettynettyMatch4.0.26
OR
nettynettyMatch4.0.27
OR
nettynettyMatch4.1.0beta1
OR
nettynettyMatch4.1.0beta2
OR
nettynettyMatch4.1.0beta3
OR
nettynettyMatch4.1.0beta4
Node
lightbendplay_frameworkMatch2.0rc3
OR
lightbendplay_frameworkMatch2.0rc4
OR
lightbendplay_frameworkMatch2.0rc5
OR
lightbendplay_frameworkMatch2.0.2
OR
lightbendplay_frameworkMatch2.0.2rc1
OR
lightbendplay_frameworkMatch2.0.2rc2
OR
lightbendplay_frameworkMatch2.0.3
OR
lightbendplay_frameworkMatch2.0.3rc1
OR
lightbendplay_frameworkMatch2.0.3rc2
OR
lightbendplay_frameworkMatch2.0.4
OR
lightbendplay_frameworkMatch2.0.4rc1
OR
lightbendplay_frameworkMatch2.0.4rc2
OR
lightbendplay_frameworkMatch2.0.5
OR
lightbendplay_frameworkMatch2.0.5rc1
OR
lightbendplay_frameworkMatch2.0.5rc2
OR
lightbendplay_frameworkMatch2.0.6
OR
lightbendplay_frameworkMatch2.0.7
OR
lightbendplay_frameworkMatch2.0.8
OR
lightbendplay_frameworkMatch2.1.0
OR
lightbendplay_frameworkMatch2.1.1
OR
lightbendplay_frameworkMatch2.1.1rc1
OR
lightbendplay_frameworkMatch2.2.0
OR
lightbendplay_frameworkMatch2.2.1
OR
lightbendplay_frameworkMatch2.2.2
OR
lightbendplay_frameworkMatch2.2.6
OR
lightbendplay_frameworkMatch2.3.0
OR
lightbendplay_frameworkMatch2.3.0rc1
OR
lightbendplay_frameworkMatch2.3.0rc2
OR
lightbendplay_frameworkMatch2.3.1
OR
lightbendplay_frameworkMatch2.3.2
OR
lightbendplay_frameworkMatch2.3.2rc1
OR
lightbendplay_frameworkMatch2.3.2rc2
OR
lightbendplay_frameworkMatch2.3.3
OR
lightbendplay_frameworkMatch2.3.4
OR
lightbendplay_frameworkMatch2.3.5
OR
lightbendplay_frameworkMatch2.3.6
OR
lightbendplay_frameworkMatch2.3.7
OR
lightbendplay_frameworkMatch2.3.8
OR
playframeworkplay_frameworkMatch2.0
OR
playframeworkplay_frameworkMatch2.0beta
OR
playframeworkplay_frameworkMatch2.0rc1
OR
playframeworkplay_frameworkMatch2.0rc2
OR
playframeworkplay_frameworkMatch2.0.1
OR
playframeworkplay_frameworkMatch2.1.12.9.x-backport
OR
playframeworkplay_frameworkMatch2.1.1rc1-2.9.x-backport
OR
playframeworkplay_frameworkMatch2.1.1rc2
OR
playframeworkplay_frameworkMatch2.1.2
OR
playframeworkplay_frameworkMatch2.1.2rc1
OR
playframeworkplay_frameworkMatch2.1.2rc2
OR
playframeworkplay_frameworkMatch2.1.3
OR
playframeworkplay_frameworkMatch2.1.3rc1
OR
playframeworkplay_frameworkMatch2.1.3rc2
OR
playframeworkplay_frameworkMatch2.1.4
OR
playframeworkplay_frameworkMatch2.1.4rc1
OR
playframeworkplay_frameworkMatch2.1.4rc2
OR
playframeworkplay_frameworkMatch2.1.5
OR
playframeworkplay_frameworkMatch2.1.6
OR
playframeworkplay_frameworkMatch2.1.6rc1
OR
playframeworkplay_frameworkMatch2.2.0m1
OR
playframeworkplay_frameworkMatch2.2.0m2
OR
playframeworkplay_frameworkMatch2.2.0m3
OR
playframeworkplay_frameworkMatch2.2.0rc1
OR
playframeworkplay_frameworkMatch2.2.0rc2
OR
playframeworkplay_frameworkMatch2.2.1rc1
OR
playframeworkplay_frameworkMatch2.2.2rc1
OR
playframeworkplay_frameworkMatch2.2.2rc2
OR
playframeworkplay_frameworkMatch2.2.2rc3
OR
playframeworkplay_frameworkMatch2.2.2rc4
OR
playframeworkplay_frameworkMatch2.2.3
OR
playframeworkplay_frameworkMatch2.2.3rc1
OR
playframeworkplay_frameworkMatch2.2.3rc2
OR
playframeworkplay_frameworkMatch2.2.4
OR
playframeworkplay_frameworkMatch2.2.5
OR
playframeworkplay_frameworkMatch2.3m1

References

Related

fedora 2
debiancve 1
nessus 2
prion 1
osv 1
openvas 2
ubuntucve 1
github 1
cvelist 1
nvd 1
ibm 6
fedora
fedora
[SECURITY] Fedora 21 Update: netty-4.0.28-1.fc21
2015-06-04 20:12:38
[SECURITY] Fedora 22 Update: netty-4.0.28-1.fc22
2015-05-30 15:39:53
debiancve
debiancve
CVE-2015-2156
2017-10-18 15:29:00
nessus
nessus
Fedora 22 : netty-4.0.28-1.fc22 (2015-8684)
2015-06-02 00:00:00
Fedora 21 : netty-4.0.28-1.fc21 (2015-8713)
2015-06-05 00:00:00
prion
prion
Input validation
2017-10-18 15:29:00
osv
osv
Information Exposure in Netty
2020-06-30 21:01:21
openvas
openvas
Fedora Update for netty FEDORA-2015-8684
2015-07-07 00:00:00
Fedora Update for netty FEDORA-2015-8713
2015-06-09 00:00:00
ubuntucve
ubuntucve
CVE-2015-2156
2017-10-18 00:00:00
github
github
Information Exposure in Netty
2020-06-30 21:01:21
cvelist
cvelist
CVE-2015-2156
2017-10-18 15:00:00
nvd
nvd
CVE-2015-2156
2017-10-18 15:29:00
ibm
ibm
Security Bulletin: Vulnerable netty classes from couchdb affecting IBM Knowledge Catalog for IBM Cloud Pak for Data
2024-06-10 21:17:47
Security Bulletin: Multiple vulnerabilities in dependent libraries affect IBM® Db2® leading to denial of service or privilege escalation.
2021-03-10 21:20:34
Security Bulletin: Multiple vulnerabilities have been identified in DB2 that affect the IBM Performance Management product
2020-05-20 14:01:42

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.3 High

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.006 Low

EPSS

Percentile

77.8%

JSON
Related for CVE-2015-2156
fedora2debiancve1nessus2prion1osv1openvas2ubuntucve1github1cvelist1nvd1ibm6