PT-2015-2731 · Emc · Emc Documentum Taskspace+4

Publicado 2015-07-04 · Atualizado 2016-12-28 · CVE-2015-4524

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions EMC Documentum Administrator versions 6.7SP1 through 6.7SP1 before P31, 6.7SP2 through 6.7SP2 before P23, 7.0 through 7.0 before P18, 7.1 through 7.1 before P15, and 7.2 through 7.2 before P01 EMC Documentum Digital Asset Management version 6.5SP6 before P25 EMC Documentum TaskSpace versions 6.7SP1 through 6.7SP1 before P31 and 6.7SP2 through 6.7SP2 before P23 EMC Documentum Web Publisher version 6.5 SP7 before P25 EMC Documentum WebTop versions 6.7SP1 through 6.7SP1 before P31, 6.7SP2 through 6.7SP2 before P23, and 6.8 through 6.8 before P01

Description The issue is related to an unrestricted file upload vulnerability. This vulnerability can be exploited by a remote attacker to execute arbitrary code by uploading a file to the Content Server.

Recommendations For EMC Documentum Administrator versions 6.7SP1 through 6.7SP1 before P31, 6.7SP2 through 6.7SP2 before P23, 7.0 through 7.0 before P18, 7.1 through 7.1 before P15, and 7.2 through 7.2 before P01, update to a version that includes the necessary patches. For EMC Documentum Digital Asset Management version 6.5SP6 before P25, update to a version that includes the necessary patches. For EMC Documentum TaskSpace versions 6.7SP1 through 6.7SP1 before P31 and 6.7SP2 through 6.7SP2 before P23, update to a version that includes the necessary patches. For EMC Documentum Web Publisher version 6.5 SP7 before P25, update to a version that includes the necessary patches. For EMC Documentum WebTop versions 6.7SP1 through 6.7SP1 before P31, 6.7SP2 through 6.7SP2 before P23, and 6.8 through 6.8 before P01, update to a version that includes the necessary patches. As a temporary workaround, consider restricting file uploads to the Content Server until a patch is available.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

BDU:2015-12096

CVE-2015-4524

Produtos afetados

Emc Documentum Administrator

Emc Documentum Digital Asset Management

Emc Documentum Taskspace

Emc Documentum Web Publisher

Emc Documentum Webtop

Referências · 6

• http://seclists.org/bugtraq/2015/Jul/att-9/ESA-2015-111.txt · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4524 · Nota
• http://securitytracker.com/id/1032770 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-4524 · Nota de Segurança
• http://seclists.org/bugtraq/2015/Jul/9 · Nota
• https://bdu.fstec.ru/vul/2015-12096 · Nota de Segurança