PT-2011-3120 · Emc · Emc Sourceone Email Management

Published 2011-05-24 · Updated 2018-10-09 · CVE-2011-1424

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions EMC SourceOne Email Management versions prior to 6.6 SP1

Description The issue arises from the default configuration of ExShortcutWeb.config in EMC SourceOne Email Management, specifically when the Mobile Services component is utilized. The localOnly attribute of the trace element is not properly set, allowing remote authenticated users to obtain sensitive information via ASP.NET Application Tracing.

Recommendations For versions prior to 6.6 SP1, update to version 6.6 SP1 or later to resolve the issue. As a temporary workaround, consider setting the localOnly attribute of the trace element to true in the ExShortcutWeb.config file to restrict access to ASP.NET Application Tracing.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2011-1424

Affected Products

Emc Sourceone Email Management

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2011-1424 · Security Note
• http://securityfocus.com/archive/1/518003/100/0/threaded · Note
• http://securityreason.com/securityalert/8258 · Note