CVE-2015-2344
published 2016-03-16CVE-2015-2344: Cross-site scripting (XSS) vulnerability in VMware vRealize Automation 6.x before 6.2.4 on Linux allows remote authenticated users to inject arbitrary web…
PriorityP422medium5.4CVSS 3.0
AVNACLPRLUIRSCCLILAN
EPSS
0.84%
57.5th percentile
Cross-site scripting (XSS) vulnerability in VMware vRealize Automation 6.x before 6.2.4 on Linux allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | vmware_vrealize | — | — |
| vmware | vrealize_automation | — | — |
| vmware | vrealize_automation | — | — |
| vmware | vrealize_automation | — | — |
| vmware | vrealize_automation | — | — |
| vmware | vrealize_automation | — | — |
| vmware | vrealize_automation | — | — |
| vmware | vrealize_automation | — | — |
| vmware | vrealize_automation | — | — |
| vmware | vrealize_automation | — | — |
| vmware | vrealize_automation | — | — |
CVSS provenance
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware vRealize Automation and vRealize Business Advanced and Enterprise address Cross-Site Scripting (XSS) issues.
vendor_vmware·2016-03-15·CVSS 5.4
CVE-2015-2344 [MEDIUM] VMware vRealize Automation and vRealize Business Advanced and Enterprise address Cross-Site Scripting (XSS) issues.
VMSA-2016-0003: VMware vRealize Automation and vRealize Business Advanced and Enterprise address Cross-Site Scripting (XSS) issues.
a. Important Stored Cross-Site Scripting (XSS) issue in VMware vRealize Automation VMware vRealize Automation contains a vulnerability that may allow for a Stored Cross-Site Scripting (XSS) attack. Exploitation of this issue may lead to the compromise of a vRA user's client workstation. VMware would like to thank Lukasz Plonka for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2015-2344 to this issue. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Product Version Running on Replace
GHSA
GHSA-8pv2-qjj8-hg9r: Cross-site scripting (XSS) vulnerability in VMware vRealize Automation 6
ghsa_unreviewed·2022-05-17
CVE-2015-2344 [MEDIUM] CWE-79 GHSA-8pv2-qjj8-hg9r: Cross-site scripting (XSS) vulnerability in VMware vRealize Automation 6
Cross-site scripting (XSS) vulnerability in VMware vRealize Automation 6.x before 6.2.4 on Linux allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2016-03-16
Published