{"api_version":"1","generated_at":"2026-07-23T07:12:56+00:00","cve":"CVE-2015-3655","urls":{"html":"https://cve.report/CVE-2015-3655","api":"https://cve.report/api/cve/CVE-2015-3655.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-3655","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-3655"},"summary":{"title":"CVE-2015-3655","description":"Cross-site request forgery (CSRF) vulnerability in Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to hijack the authentication of administrators by leveraging improper enforcement of the anti-CSRF token.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2017-08-29 15:29:00","updated_at":"2020-10-01 16:41:00"},"problem_types":["CWE-352"],"metrics":[],"references":[{"url":"http://www.securityfocus.com/bid/100594","name":"100594","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"Aruba Networks ClearPass Policy Manager CVE-2015-3655 Cross Site Request Forgery Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-009.txt","name":"http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-009.txt","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3655","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3655","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"3655","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"arubanetworks","cpe5":"clearpass","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"3655","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"arubanetworks","cpe5":"clearpass","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2015-3655","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site request forgery (CSRF) vulnerability in Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to hijack the authentication of administrators by leveraging improper enforcement of the anti-CSRF token."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-009.txt","refsource":"CONFIRM","url":"http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-009.txt"},{"name":"100594","refsource":"BID","url":"http://www.securityfocus.com/bid/100594"}]}},"nvd":{"publishedDate":"2017-08-29 15:29:00","lastModifiedDate":"2020-10-01 16:41:00","problem_types":["CWE-352"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.8},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:arubanetworks:clearpass:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5.0","versionEndExcluding":"6.5.2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:arubanetworks:clearpass:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4.0","versionEndExcluding":"6.4.7","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"3655","Ordinal":"80610","Title":"CVE-2015-3655","CVE":"CVE-2015-3655","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"3655","Ordinal":"1","NoteData":"Cross-site request forgery (CSRF) vulnerability in Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to hijack the authentication of administrators by leveraging improper enforcement of the anti-CSRF token.","Type":"Description","Title":null},{"CveYear":"2015","CveId":"3655","Ordinal":"2","NoteData":"2017-08-29","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"3655","Ordinal":"3","NoteData":"2017-09-05","Type":"Other","Title":"Modified"}]}}}