CVE-2015-2917
Medium
Description
Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally omit the X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site that contains a (1) FRAME, (2) IFRAME, or (3) OBJECT element.
SeverityMedium
CVSS4.3
Exploit probability60. percentile0.9%
ProductSecurifi Almond Firmware
PublishedSep 21, 2015
First seenSep 21, 2015
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| securifi almond_firmware | v ≤ al1-r201exp10-l304-w33 | — |
| securifi almond-2015_firmware | v ≤ al2-r088 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.