PT-2011-3120 · Emc · Emc Sourceone Email Management

Publicado 2011-05-24 · Atualizado 2018-10-09 · CVE-2011-1424

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions EMC SourceOne Email Management versions prior to 6.6 SP1

Description The issue arises from the default configuration of ExShortcutWeb.config in EMC SourceOne Email Management, specifically when the Mobile Services component is utilized. The localOnly attribute of the trace element is not properly set, allowing remote authenticated users to obtain sensitive information via ASP.NET Application Tracing.

Recommendations For versions prior to 6.6 SP1, update to version 6.6 SP1 or later to resolve the issue. As a temporary workaround, consider setting the localOnly attribute of the trace element to true in the ExShortcutWeb.config file to restrict access to ASP.NET Application Tracing.

Correção

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2011-1424

Produtos afetados

Emc Sourceone Email Management

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2011-1424 · Nota de Segurança
• http://securityfocus.com/archive/1/518003/100/0/threaded · Nota
• http://securityreason.com/securityalert/8258 · Nota