CVE-2015-2009

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Cross-site request forgery (CSRF) vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.x before 7.2.5 Patch 4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences via vectors related to webmin. IBM X-Force ID: 103921.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Mar 29, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-201059.6The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logge CVE-2015-201064.8The ClickBank Affiliate Ads WordPress plugin through 1.20 does not escape its settings, allowing high privilege users to perform Cross-Site CVE-2015-201077.6In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file.CVE-2015-201089.8xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not use CVE-2015-201095.5end_pattern (called from internal_fnmatch) in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to CVE-2015-20119.0The xmlrpc.cgi Webmin script in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated user CVE-2015-201107.5JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first ch CVE-2015-201119.8miniupnp before 4c90b87, as used in Bitcoin Core before 0.12 and other products, lacks checks for snprintf return values, leading to a buffe CVE-2015-201123.4RLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption on a private network.CVE-2015-201134.3Next Click Ventures RealtyScript 4.0.2 contains cross-site request forgery and persistent cross-site scripting vulnerabilities that allow at CVE-2015-201146.1Next Click Ventures RealtyScript 4.0.2 contains a cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and scr CVE-2015-201156.1Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize file uploads, allowing attackers to store malicious scripts through the fi