VulnerabilityModified
CVE-2015-2828
CA Spectrum 9.2.x and 9.3.x before 9.3 H02 does not properly validate serialized Java objects, which allows remote authenticated users to obtain administrative privileges via crafted object data.
HIGH 9.0EPSS 3.24%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
CA Spectrum 9.2.x and 9.3.x before 9.3 H02 does not properly validate serialized Java objects, which allows remote authenticated users to obtain administrative privileges via crafted object data.
- CVSS 2.0
- 9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C
- EPSS
- 3.24% probability · 88th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- broadcom/spectrum
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/131330/Security-Notice-For-CA-Spectrum.html
- http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20150407-01-security-notice-for-ca-spectrum.aspxVendor Advisory
- http://www.securityfocus.com/archive/1/535205/100/0/threaded
- http://www.securityfocus.com/bid/73957
- http://packetstormsecurity.com/files/131330/Security-Notice-For-CA-Spectrum.html
- http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20150407-01-security-notice-for-ca-spectrum.aspxVendor Advisory
- http://www.securityfocus.com/archive/1/535205/100/0/threaded
- http://www.securityfocus.com/bid/73957
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.