PT-2014-4753 · Emc · Emc Documentum D2

Publicado 2014-08-20 · Atualizado 2017-08-29 · CVE-2014-2515

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EMC Documentum D2 versions 3.1 before P24 EMC Documentum D2 version 3.1SP1 before P02 EMC Documentum D2 version 4.0 before P11 EMC Documentum D2 version 4.1 before P16 EMC Documentum D2 version 4.2 before P05

Description The issue allows remote authenticated users to gain privileges via a request for a superuser ticket, due to improper restriction of tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod.

Recommendations For version 3.1, update to P24 or later. For version 3.1SP1, update to P02 or later. For version 4.0, update to P11 or later. For version 4.1, update to P16 or later. For version 4.2, update to P05 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-2515

Produtos afetados

Emc Documentum D2

Referências · 6

• http://securitytracker.com/id/1030740 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95367 · Nota
• http://secunia.com/advisories/60565 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2515 · Nota de Segurança
• http://securityfocus.com/bid/69275 · Nota
• http://securityfocus.com/archive/1/533161/30/0/threaded · Nota