CVE-2015-6854

Severity: critical (CVSS 9.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-03-24 · updated 2026-06-17
Weakness: CWE-345

Description

The non-Domino web agents in CA Single Sign-On (aka SSO, formerly SiteMinder) R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5 allow remote attackers to cause a denial of service (daemon crash) or obtain sensitive information via a crafted request.

Affected products

Broadcom Single Sign-On: r6.0, r12.0, r12.0j, r12.5

References

http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20160323-01-security-notice-for-ca-single-sign-on-web-agents.aspx
http://www.securitytracker.com/id/1035389
http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20160323-01-security-notice-for-ca-single-sign-on-web-agents.aspx
http://www.securitytracker.com/id/1035389

Get alerted when CVE-2015-6854 or the next vulnerability affects your stack