« Volver al listado

CVE-2015-0544

Estado: ModificadaAlta (9.3)—

EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

EMC — Secure Remote Services

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-0544",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-07-05T10:59:01.020",
  "references": [
    {
      "url": "http://seclists.org/bugtraq/2015/Jun/132",
      "source": "security_alert@emc.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1032740",
      "source": "security_alert@emc.com"
    },
    {
      "url": "http://seclists.org/bugtraq/2015/Jun/132",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1032740",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value."
    },
    {
      "lang": "es",
      "value": "EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x anterior a 3.06 no genera correctamente los valores aleatorios para las cookies de sesión, lo que facilita a atacantes remotos secuestrar sesiones mediante la previsión de un valor."
    }
  ],
  "lastModified": "2026-06-17T00:20:29.987",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:emc:secure_remote_services:3.02:*:*:*:virtual:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "01FFD337-155A-403F-9270-09A0DF8D4161"
            },
            {
              "criteria": "cpe:2.3:a:emc:secure_remote_services:3.03:*:*:*:virtual:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C9FDED1-65A7-44D3-A345-392F0B8C6D27"
            },
            {
              "criteria": "cpe:2.3:a:emc:secure_remote_services:3.04:*:*:*:virtual:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "81ADA2EB-71C4-4152-B1E6-1E038CA73C39"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "<a href=\"https://cwe.mitre.org/data/definitions/331.html\">CWE-331: Insufficient Entropy</a>",
  "sourceIdentifier": "security_alert@emc.com"
}