Vulnerability CVE-2015-0517
Published: 2015-02-14

Description:
The D2-API component in EMC Documentum D2 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 places the MD5 hash of an encryption passphrase in log files, which allows remote authenticated users to obtain sensitive information by reading a file.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
EMC Documentum D2 Information Disclosure / Privilege Escalation
EMC
05.02.2015

Type:

CWE-264

 (Permissions, Privileges, and Access Controls)

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4/10
2.9/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
EMC -> Documentum d2 

 References:
http://archives.neohapsis.com/archives/bugtraq/2015-02/0031.html
http://www.securityfocus.com/bid/72501
http://www.securitytracker.com/id/1031693
https://exchange.xforce.ibmcloud.com/vulnerabilities/100874
Copyright 2024, cxsecurity.com

 

Back to Top