PT-2015-1697 · Emc · Emc Documentum Centerstage

Published 2015-07-16 · Updated 2017-09-22 · CVE-2015-4528

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions EMC Documentum CenterStage versions 1.2SP1 through 1.2SP2

Description The issue exists due to insufficient protection of the web page structure, allowing for the exploitation of a cross-site scripting (XSS) vulnerability. This could enable a remote attacker to execute arbitrary HTML code. The vulnerability can be exploited by injecting arbitrary web script or HTML via unspecified vectors, but it requires remote authenticated users.

Recommendations For versions 1.2SP1 and 1.2SP2, consider restricting access to the web interface until a patch is available. As a temporary workaround, avoid using the web interface for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2015-11043

CVE-2015-4528

Affected Products

Emc Documentum Centerstage

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-4528 · Security Note
• https://bdu.fstec.ru/vul/2015-11043 · Security Note
• http://securitytracker.com/id/1032966 · Note
• http://seclists.org/bugtraq/2015/Jul/80 · Note
• http://securityfocus.com/bid/75929 · Note