CVE-2015-3454 describes a vulnerability in TelescopeJS versions prior to 0.15, specifically affecting products like VulcanJS. This flaw allows user bcrypt password hashes to be leaked in websocket messages, which can be exploited by remote attackers through cross-site scripting (XSS) attacks. The vulnerability is rated with a CVSS score of 7.5 (HIGH), indicating a high impact on confidentiality due to the potential exposure of sensitive user credentials, with a network attack vector and low attack complexity. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB, nor has it garnered significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 0.14.3CPE matchmatch criteria | cpe:2.3:a:vulcanjs:vulcan:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.