Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

IBM Flash System V9000 can let attackers hijack logins

CVE-2015-7446 · published 10 years ago
Summary

The storage system firmware for IBM Flash System V9000 (versions before 7.4.1.4, 7.5.1.3, and 7.6.0.4) can be tricked into accepting forged web requests. An attacker could take over a user's session and insert malicious code into the system. Update the firmware to the latest version to close this gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm flashsystem_v9000_firmware 7.4
7.5
7.6
cpe:2.3:o:ibm:flashsystem_v9000_firmware:7.4:*:*:*:*:*:*:*
Original advisory text
Cross-site request forgery (CSRF) vulnerability in IBM Flash System V9000 7.4 before 7.4.1.4, 7.5 before 7.5.1.3, and 7.6 before 7.6.0.4 allows remote attackers to hijack the authentication of arbi...
Cross-site request forgery (CSRF) vulnerability in IBM Flash System V9000 7.4 before 7.4.1.4, 7.5 before 7.5.1.3, and 7.6 before 7.6.0.4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published12 Mar 2016
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2015-7446 · NVD
Track software like this
Free during beta