CVE-2015-2954

MEDIUM 6.8CVE-2015-2954 · Published 13/06/2015 · updated 17/06/2026

In short

CVE-2015-2954 is a MEDIUM (CVSS 6.8) vulnerability affecting milkystep light (igreks), milkystep professional (igreks), milkystep professional oem (igreks).
Chance of exploitation in the next 30 days (EPSS): 0.64%, higher than 51.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
milkystep light igreks	`≤ 0.94`	No fix yet
milkystep professional igreks	`≤ 1.82`	No fix yet
milkystep professional oem igreks	`≤ 1.82`	No fix yet

Description

Cross-site request forgery (CSRF) vulnerability in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to hijack the authentication of arbitrary users.

References

jvn.jp/en/jp/JVN12241436/995646/index.html
jvn.jp/en/jp/JVN12241436/index.html · Vendor Advisory
jvndb.jvn.jp/jvndb/JVNDB-2015-000079 · Vendor Advisory
securityfocus.com/bid/75072

More vulnerabilities in milkystep light

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

In short

CVE-2015-2954 is a MEDIUM (CVSS 6.8) vulnerability affecting milkystep light (igreks), milkystep professional (igreks), milkystep professional oem (igreks).

Chance of exploitation in the next 30 days (EPSS): 0.64%, higher than 51.0% of all vulnerabilities.

No patched version is listed yet: follow the vendor's advisory in References.

Package

Affected versions

Patched versions

milkystep light

igreks

≤ 0.94

No fix yet

milkystep professional

igreks

≤ 1.82

No fix yet

milkystep professional oem

igreks

≤ 1.82

No fix yet

More vulnerabilities in milkystep light

See all →