CVE-2015-2169 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	2.17%	–	–
2022-03-13	–	–	2.17%	–	–
2022-04-03	–	–	2.17%	–	–
2022-06-26	–	–	2.17%	–	–
2022-11-13	–	–	1.95%	–	–
2023-01-01	–	–	1.95%	–	–
2023-01-15	–	–	1.95%	–	–
2023-03-12	–	–	–	3.17%	–
2023-05-21	–	–	–	2.44%	–
2023-07-16	–	–	–	2.44%	–
2023-08-27	–	–	–	2.06%	–
2023-12-10	–	–	–	1.04%	–
2024-02-11	–	–	–	1.04%	–
2024-03-03	–	–	–	1.04%	–
2024-06-02	–	–	–	1.04%	–
2024-11-24	–	–	–	1.04%	–
2024-12-22	–	–	–	0.6%	–
2025-02-02	–	–	–	0.6%	–
2025-02-09	–	–	–	0.6%	–
2025-01-19	–	–	–	0.6%	–
2025-02-16	–	–	–	0.6%	–
2025-03-18	–	–	–	–	4.71%
2025-03-30	–	–	–	–	4.23%
2025-03-30	–	–	–	–	4.23,%

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Date	Percentile
2022-02-06	58%
2022-03-13	59%
2022-04-03	79%
2022-06-26	8%
2022-11-13	78%
2023-01-01	77%
2023-01-15	78%
2023-03-12	9%
2023-05-21	88%
2023-07-16	89%
2023-08-27	88%
2023-12-10	82%
2024-02-11	83%
2024-03-03	84%
2024-06-02	84%
2024-11-24	85%
2024-12-22	78%
2025-02-02	78%
2025-02-09	79%
2025-01-19	78%
2025-02-16	79%
2025-03-18	89%
2025-03-30	88%
2025-03-30	88%

Title: =============== ManageEngine Asset Explorer v6.1 - XSS Vulnerability CVE-ID: ==================================== CVE-2015-2169 CVSS: ==================================== 3.5 Product & Service Introduction (Taken from their homepage): ==================================== ManageEngine AssetExplorer is a web-based IT Asset Management (ITAM) software that helps you monitor and manage assets in your network from Planning phase to Disposal phase. AssetExplorer provides you with a number of ways to ensure discovery of all the assets in your network. You can manage software & hardware assets, ensure software license compliance and track purchase orders & contracts - the whole nine yards! AssetExplorer is very easy to install and works right out of the box. (Homepage: https://www.manageengine.com/products/asset-explorer/ ) Abstract Advisory Information: ============================== Cross site scripting attack can be performed on the manage engine asset explorer. If the 'publisher' name contains vulnerable script, it gets executed in the browser. Affected Products: ==================== Manage Engine Product: Asset Explorer - Web Application 6.1.0 (Build 6112) Severity Level: ==================== Medium Technical Details & Description: ================================ Add a vendor with a script in it to the registry. Login to the product, Scan the endpoint where the registry is modified. In the right pane, go to software->Scanned Software The script gets executed. Vulnerable Product(s): ManageEngine Asset Explorer Affected Version(s): Version 6.1.0 / Build Number 6112 (Earlier versions i did not test) Vulnerability Type(s): Persistent Cross Site Scripting PoC: ======================= Add the following registry entry in the machine, for targeted attack. Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fake_Software] "DisplayName"="A fake software 2 installed" "UninstallString"="C:\\Program Files\\fake\\uninst.exe" "DisplayVersion"="0.500.20" "URLInfoAbout"="http://www.dummy.org" "Publisher"="<script> alert(\"XSS\"); </script>" Security Risk: ================== Medium. Credits & Authors: ================== Suraj Krishnaswami (suraj.krishnaswami@gmail.com) Timeline: ================== Discovered at Wed, March 3, 2015 Informed manage engine about the vulnerability: March 4, 2015 Case moved to development team: March 4, 2015 Asked for updates: March 9, 2015 Asked for updates: March 13, 2015 Asked for updates: April 14, 2015 Public Disclosure at Mon, June 22, 2015