« Volver al listado

CVE-2015-0547

Estado: ModificadaMedia (4)—

The D2CenterstageService.getComments service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended read-access restrictions via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

EMC — Documentum D2

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-0547",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-07-04T10:59:00.090",
  "references": [
    {
      "url": "http://seclists.org/bugtraq/2015/Jul/10",
      "source": "security_alert@emc.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1032769",
      "source": "security_alert@emc.com"
    },
    {
      "url": "http://seclists.org/bugtraq/2015/Jul/10",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1032769",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The D2CenterstageService.getComments service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended read-access restrictions via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "El método de servicio D2CenterstageService.getComments en EMC Documentum D2 4.1 y 4.2 anterior a 4.2 P16 y 4.5 anterior a P03 permite a usuarios remotos autenticados realizar ataques de inyección Documentum Query Language (DQL) y evadir las restricciones de acceso a lectura a través de vectores no especificados."
    }
  ],
  "lastModified": "2026-06-17T00:20:30.273",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:emc:documentum_d2:4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F39C8470-59DA-4759-A8B4-2DEE6DCAAE1A"
            },
            {
              "criteria": "cpe:2.3:a:emc:documentum_d2:4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC69558D-8121-4CA9-BABB-9ACF77808706"
            },
            {
              "criteria": "cpe:2.3:a:emc:documentum_d2:4.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "74C159C3-E978-4DDD-BF04-7756F9080485"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}