PT-2015-1697 · Emc · Emc Documentum Centerstage

Publicado 2015-07-16 · Atualizado 2017-09-22 · CVE-2015-4528

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions EMC Documentum CenterStage versions 1.2SP1 through 1.2SP2

Description The issue exists due to insufficient protection of the web page structure, allowing for the exploitation of a cross-site scripting (XSS) vulnerability. This could enable a remote attacker to execute arbitrary HTML code. The vulnerability can be exploited by injecting arbitrary web script or HTML via unspecified vectors, but it requires remote authenticated users.

Recommendations For versions 1.2SP1 and 1.2SP2, consider restricting access to the web interface until a patch is available. As a temporary workaround, avoid using the web interface for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2015-11043

CVE-2015-4528

Produtos afetados

Emc Documentum Centerstage

Referências · 5

• http://securitytracker.com/id/1032966 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-4528 · Nota de Segurança
• http://seclists.org/bugtraq/2015/Jul/80 · Nota
• http://securityfocus.com/bid/75929 · Nota
• https://bdu.fstec.ru/vul/2015-11043 · Nota de Segurança