EMC Documentum Content Server up to 6.7/7.0/7.1/7.2 RPC Tracing Password information disclosure : 8/21/2015 4:38:03 AM

This set of templates helps you define your app feature roadmap, now and over time.
From our sponsors
 

 

Vulnerability Advisories
Vulnerabilities of scip VulDB

EMC Documentum Content Server up to 6.7/7.0/7.1/7.2 RPC Tracing Password information disclosure
8/19/2015 7:00:00 PM

General

scipID: 77363
Affected: EMC Documentum Content Server up to 6.7/7.0/7.1/7.2
Published: 08/20/2015
Risk: problematic

Created: 08/21/2015
Entry: 66.3% complete

Summary

A vulnerability was found in EMC Documentum Content Server up to 6.7/7.0/7.1/7.2. It has been rated as problematic. This issue affects an unknown function of the component RPC Tracing. The manipulation with an unknown input leads to a information disclosure vulnerability (password). Impacted is confidentiality. The summary by CVE is:

EMC Documentum Content Server before 7.0 P20, 7.1 before P18, and 7.2 before P02, when RPC tracing is configured, stores certain obfuscated password data in a log file, which allows remote authenticated users to obtain sensitive information by reading this file.

The weakness was presented 08/20/2015. The identification of this vulnerability is CVE-2015-4536. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available.

Applying a patch is able to eliminate this problem.

CVSS

Base Score: 3.5 (CVSS2#AV:N/AC:M/Au:S/C:P/I:N/A:N) [?]
Temp Score: 3.0 (CVSS2#E:ND/RL:OF/RC:ND) [?]

CPE

Exploiting

Class: Information disclosure
Local: No
Remote: Yes

Availability: No

Countermeasures

Recommended: Patch
Status: Official fix
0-Day Time: 0 days since found

Timeline

08/20/2015 | Advisory disclosed
08/21/2015 | VulDB entry created
08/21/2015 | VulDB entry updated

Sources

CVE: CVE-2015-4536 (mitre.org) (nvd.nist.org) (cvedetails.com)

 

You are receiving this email because you subscribed to this feed at feedmyinbox.com

If you no longer wish to receive these emails, you can unsubscribe from this feed, or manage all your subscriptions

Diberdayakan oleh Blogger.