PT-2015-3768 · Emc · Emc Documentum Web Development Kit

Published 2015-01-07 · Updated 2017-08-29 · CVE-2014-4639

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions EMC Documentum Web Development Kit (WDK) versions prior to 6.8

Description The issue makes it easier for remote attackers to conduct phishing attacks via brute-force attempts to predict a certain parameter value related to Webtop components, due to improper generation of random numbers for this parameter.

Recommendations For versions prior to 6.8, update to version 6.8 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2014-4639

Affected Products

Emc Documentum Web Development Kit

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-4639 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2015-01/0009.html · Note
• http://securitytracker.com/id/1031497 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99636 · Note
• http://packetstormsecurity.com/files/129822/EMC-Documentum-Web-Development-Kit-XSS-CSRF-Redirection-Injection.html · Note