Lucene search

[email protected]CVE-2015-9245

HistoryOct 31, 2017 - 7:29 a.m.

CVE-2015-9245

2017-10-3107:29:00

CWE-284

[email protected]

web.nvd.nist.gov

270

cve

insecure default configuration

remote code execution

progress software openedge

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

72.8%

JSON

Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URLs from which to load and execute malicious Java classes via port 20931.

CPENameOperatorVersion
progress:openedgeprogress openedgeeq11.2
progress:openedgeprogress openedgeeq11.5
progress:openedgeprogress openedgeeq11.4
progress:openedgeprogress openedgeeq11.3
progress:openedgeprogress openedgeeq11.1
progress:openedgeprogress openedgeeq11.0
progress:openedgeprogress openedgeeq10.2b08
progress:openedgeprogress openedgeeq10.2b07
progress:openedgeprogress openedgeeq10.2a
progress:openedgeprogress openedgeeq10.2b

CPE	Name	Operator	Version
progress:openedge	progress openedge	eq	11.2
progress:openedge	progress openedge	eq	11.5
progress:openedge	progress openedge	eq	11.4
progress:openedge	progress openedge	eq	11.3
progress:openedge	progress openedge	eq	11.1
progress:openedge	progress openedge	eq	11.0
progress:openedge	progress openedge	eq	10.2b08
progress:openedge	progress openedge	eq	10.2b07
progress:openedge	progress openedge	eq	10.2a
progress:openedge	progress openedge	eq	10.2b

References

knowledgebase.progress.com/articles/Article/How-to-prevent-Java-RMI-class-loader-exploit-with-AdminServer

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

72.8%

JSON

Related for CVE-2015-9245

prion1