PT-2014-4753 · Emc · Emc Documentum D2

Published 2014-08-20 · Updated 2017-08-29 · CVE-2014-2515

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EMC Documentum D2 versions 3.1 before P24 EMC Documentum D2 version 3.1SP1 before P02 EMC Documentum D2 version 4.0 before P11 EMC Documentum D2 version 4.1 before P16 EMC Documentum D2 version 4.2 before P05

Description The issue allows remote authenticated users to gain privileges via a request for a superuser ticket, due to improper restriction of tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod.

Recommendations For version 3.1, update to P24 or later. For version 3.1SP1, update to P02 or later. For version 4.0, update to P11 or later. For version 4.1, update to P16 or later. For version 4.2, update to P05 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-2515

Affected Products

Emc Documentum D2

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-2515 · Security Note
• http://securitytracker.com/id/1030740 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95367 · Note
• http://secunia.com/advisories/60565 · Note
• http://securityfocus.com/bid/69275 · Note
• http://securityfocus.com/archive/1/533161/30/0/threaded · Note