« Volver al listado

CVE-2015-0532

Estado: ModificadaAlta (7.5)—

EMC RSA Identity Management and Governance (IMG) 6.9 before P04 and 6.9.1 before P01 does not properly restrict password resets, which allows remote attackers to obtain access via crafted use of the reset process for an arbitrary valid account name, as demonstrated by a privileged account.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

EMC — RSA Identity Management AND Governance

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-0532",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-05-01T10:59:00.073",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/131710/RSA-IMG-6.9-6.9.1-Insecure-Password-Reset.html",
      "source": "security_alert@emc.com"
    },
    {
      "url": "http://seclists.org/bugtraq/2015/Apr/204",
      "source": "security_alert@emc.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1032218",
      "source": "security_alert@emc.com"
    },
    {
      "url": "http://packetstormsecurity.com/files/131710/RSA-IMG-6.9-6.9.1-Insecure-Password-Reset.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/bugtraq/2015/Apr/204",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1032218",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "EMC RSA Identity Management and Governance (IMG) 6.9 before P04 and 6.9.1 before P01 does not properly restrict password resets, which allows remote attackers to obtain access via crafted use of the reset process for an arbitrary valid account name, as demonstrated by a privileged account."
    },
    {
      "lang": "es",
      "value": "EMC RSA Identity Management and Governance (IMG) 6.9 anterior a P04 y 6.9.1 anterior a P01 no restringe correctamente las reconfiguraciones de contraseñas, lo que permite a atacantes remotos obtener el acceso a través de el uso manipulado del proceso de reconfiguración para un nombre de cuenta válido arbitrario, tal y como fue demostrado por una cuenta privilegiada."
    }
  ],
  "lastModified": "2026-06-17T00:20:28.807",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0EFA9B3D-507A-49CD-9DA5-3CC984EE4E64"
            },
            {
              "criteria": "cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E8784E8C-B027-446D-92E3-E1FF3CA90BA2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}