PT-2015-2732 · Emc · Emc Documentum Taskspace+4

Publicado 2015-08-20 · Atualizado 2016-11-28 · CVE-2015-4530

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions EMC Documentum Administrator versions through 7.2 EMC Documentum Digital Asset Management versions through 6.5SP6 EMC Documentum TaskSpace versions through 6.7SP2 EMC Documentum Web Publisher versions through 6.5SP7 EMC Documentum WebTop versions before 6.8P01

Description The issue is related to a cross-site request forgery (CSRF) that can be exploited by a remote attacker to hijack the authentication of arbitrary users. This can allow the attacker to capture user authentication details.

Recommendations For EMC Documentum Administrator versions through 7.2, update to a version later than 7.2. For EMC Documentum Digital Asset Management versions through 6.5SP6, update to a version later than 6.5SP6. For EMC Documentum TaskSpace versions through 6.7SP2, update to a version later than 6.7SP2. For EMC Documentum Web Publisher versions through 6.5SP7, update to a version later than 6.5SP7. For EMC Documentum WebTop versions before 6.8P01, update to version 6.8P01 or later.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

BDU:2015-12097

CVE-2015-4530

Produtos afetados

Emc Documentum Administrator

Emc Documentum Digital Asset Management

Emc Documentum Taskspace

Emc Documentum Web Publisher

Emc Documentum Webtop

Referências · 6

• http://securityfocus.com/bid/76405 · Nota
• https://bdu.fstec.ru/vul/2015-12097 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4530 · Nota
• http://seclists.org/bugtraq/2015/Aug/87 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-4530 · Nota de Segurança
• http://seclists.org/bugtraq/2015/Aug/att-87/ESA-2015-130.txt · Nota