Login Request a demo
Unscored severity · published Nov 19, 2015
CVE-2015-4112
The Management Console in BlackBerry Enterprise Server (BES) 12 before 12.2 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct…
–
CVSS
1.1%
EPSS
No
On KEV
Description
The Management Console in BlackBerry Enterprise Server (BES) 12 before 12.2 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site, related to a "cross frame scripting" issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Enterprise Server · Blackberry
12.0; 12.1 · source: NVD
Affected product
ES
Enterprise Server
Blackberry
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-4112
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-4112
Vendor Advisory
http://www.blackberry.com/btsc/KB37573
www.securitytracker.com
http://www.securitytracker.com/id/1034154
More from Enterprise Server
6.1
CVE-2016-3126
Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arbitrary web script or…
6.1
CVE-2016-1918
Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arbitrary web script or…
6.1
CVE-2016-1917
Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arbitrary web script or…
5.4
CVE-2016-1916
Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote authenticated users to inject arbitrary web…
–
CVE-2014-1469
BlackBerry Enterprise Server 5.x before 5.0.4 MR7 and Enterprise Service 10.x before 10.2.2 log cleartext credentials during exception handling, which allows local users to obtain…