PT-2015-6613 · Emc · Emc Documentum Content Server

Published 2015-08-20 · Updated 2017-09-21 · CVE-2015-4536

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions EMC Documentum Content Server versions prior to 7.0 P20 EMC Documentum Content Server versions 7.1 prior to P18 EMC Documentum Content Server versions 7.2 prior to P02

Description The issue allows remote authenticated users to obtain sensitive information by reading a log file when RPC tracing is configured. This is because certain obfuscated password data is stored in the log file.

Recommendations For versions prior to 7.0 P20, update to version 7.0 P20 or later to resolve the issue. For versions 7.1 prior to P18, update to version 7.1 P18 or later to resolve the issue. For versions 7.2 prior to P02, update to version 7.2 P02 or later to resolve the issue. As a temporary workaround, consider disabling RPC tracing to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-4536

Affected Products

Emc Documentum Content Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-4536 · Security Note
• http://securityfocus.com/bid/76412 · Note
• http://securitytracker.com/id/1033296 · Note
• http://seclists.org/bugtraq/2015/Aug/86 · Note