Security readout for executives and security teams
Plain-English summary
Skybox Platform versions before 7.5.401 had reflected cross-site scripting in a web service and the login page. An attacker could potentially trick a user into opening crafted content that runs script in that user’s browser. The source bundle does not show active exploitation or a CVSS score.
Executive priority
Treat this as a targeted remediation item for any legacy Skybox deployment. It is not KEV-listed in the provided bundle, but administrative security platforms are sensitive assets and outdated exposed interfaces should be corrected promptly.
Technical view
The CVE describes reflected XSS in Skybox Platform before 7.5.401. Reported vectors are /skyboxview/webservice/services/VersionRepositoryWebService through a soapenv:Body element and login.html through the status parameter. No CVSS, CWE, exploit status, or detailed vendor mitigation is included in the provided data.
Likely exposure
Exposure is likely limited to organizations running Skybox Platform before 7.5.401 where the affected web interface or service is reachable by users or administrators.
Exploitation context
No CISA KEV listing or cited source in the bundle confirms active exploitation. Reflected XSS typically depends on getting a victim to interact with attacker-controlled content, but the bundle does not provide exploit prerequisites.
Researcher notes
The public record is sparse: version threshold and two reflected XSS locations are known, but severity scoring, authentication context, exploit maturity, and vendor advisory detail are incomplete in the provided bundle. Avoid assuming broader Skybox products are affected.
Mitigation direction
- Identify all Skybox Platform deployments and record versions.
- Upgrade affected deployments to Skybox Platform 7.5.401 or later.
- Restrict access to Skybox administrative web interfaces where feasible.
- Review Skybox or SEC Consult guidance before applying compensating controls.
- Prioritize browser session protections for administrative users.
Validation and detection
- Confirm no production instance runs a version before 7.5.401.
- Review exposed routes for login.html and VersionRepositoryWebService reachability.
- Check web access logs for suspicious requests to the affected paths or parameters.
- Verify administrative interfaces are not unnecessarily internet-accessible.
- Document remediation evidence for vulnerability management records.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2015-9247 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20151210-0_Skybox_Platform_Multiple_Vulnerabilities_v10.txtCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.