Detections
Analytics

CVE-2015-2959

critical

Description

Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role.

References

https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permissions-cross-site-scripting-cross-site-request-forgery-over-build-10250

http://www.securitytracker.com/id/1032516

http://www.securityfocus.com/bid/75065

http://jvndb.jvn.jp/jvndb/JVNDB-2015-000075

http://jvn.jp/en/jp/JVN25598413/index.html

Details

Source: Mitre, NVD

Published: 2015-06-09

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Severity: Critical

EPSS

EPSS: 0.00824