CVE-2015-5460: Cross-site scripting (XSS) vulnerability in app/views/events/_menu.html.erb in Snorby 2.6.2 allows remote a...

Security readout for executives and security teams

CVE-2015-5460 is a stored cross-site scripting issue in Snorby 2.6.2. A malicious classification title could be saved and later rendered in the events menu, causing script or HTML to run in another user’s browser. Business urgency depends on whether Snorby is deployed and who can create classifications. Exposure is limited to environments running Snorby 2.6.2, especially instances where classification creation is available to untrusted or lower-trust users. Public internet exposure would increase concern, but the source bundle does not confirm default deployment exposure or authentication requirements. Prioritize remediation if Snorby 2.6.2 is still used in security operations, because stored XSS can compromise analyst sessions and trust in monitoring workflows. If Snorby is not deployed, record as not applicable. Mitigation focus: Inventory Snorby deployments and confirm whether version 2.6.2 is present.; Review and apply the referenced upstream Snorby fix or a release containing it.; Restrict classification creation to trusted administrators until remediation is confirmed..

Prepared

Jun 13, 2026, 22:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.