PT-2015-2732 · Emc · Emc Documentum Taskspace+4

Published 2015-08-20 · Updated 2016-11-28 · CVE-2015-4530

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions EMC Documentum Administrator versions through 7.2 EMC Documentum Digital Asset Management versions through 6.5SP6 EMC Documentum TaskSpace versions through 6.7SP2 EMC Documentum Web Publisher versions through 6.5SP7 EMC Documentum WebTop versions before 6.8P01

Description The issue is related to a cross-site request forgery (CSRF) that can be exploited by a remote attacker to hijack the authentication of arbitrary users. This can allow the attacker to capture user authentication details.

Recommendations For EMC Documentum Administrator versions through 7.2, update to a version later than 7.2. For EMC Documentum Digital Asset Management versions through 6.5SP6, update to a version later than 6.5SP6. For EMC Documentum TaskSpace versions through 6.7SP2, update to a version later than 6.7SP2. For EMC Documentum Web Publisher versions through 6.5SP7, update to a version later than 6.5SP7. For EMC Documentum WebTop versions before 6.8P01, update to version 6.8P01 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2015-12097

CVE-2015-4530

Affected Products

Emc Documentum Administrator

Emc Documentum Digital Asset Management

Emc Documentum Taskspace

Emc Documentum Web Publisher

Emc Documentum Webtop

References · 6

• https://bdu.fstec.ru/vul/2015-12097 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-4530 · Security Note
• http://securityfocus.com/bid/76405 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4530 · Note
• http://seclists.org/bugtraq/2015/Aug/87 · Note
• http://seclists.org/bugtraq/2015/Aug/att-87/ESA-2015-130.txt · Note