« Volver al listado

CVE-2015-4530

Estado: ModificadaMedia (6.8)—

Cross-site request forgery (CSRF) vulnerability in EMC Documentum WebTop before 6.8P01, Documentum Administrator through 7.2, Documentum Digital Assets Manager through 6.5SP6, Documentum Web Publishers through 6.5SP7, and Documentum Task Space through 6.7SP2 allows remote attackers to hijack the authentication of arbitrary users. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2518.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

EMC — Documentum AdministratorEMC — Documentum Digital Asset ManagerEMC — Documentum TaskspaceEMC — Documentum WEB PublisherEMC — Documentum Webtop

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-4530",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-08-20T10:59:11.887",
  "references": [
    {
      "url": "http://seclists.org/bugtraq/2015/Aug/87",
      "source": "security_alert@emc.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/76405",
      "source": "security_alert@emc.com"
    },
    {
      "url": "http://seclists.org/bugtraq/2015/Aug/87",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/76405",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site request forgery (CSRF) vulnerability in EMC Documentum WebTop before 6.8P01, Documentum Administrator through 7.2, Documentum Digital Assets Manager through 6.5SP6, Documentum Web Publishers through 6.5SP7, and Documentum Task Space through 6.7SP2 allows remote attackers to hijack the authentication of arbitrary users.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2518."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de CSRF en EMC Documentum WebTop en versiones anteriores a 6.8P01, Documentum Administrator hasta la versión 7.2, Documentum Digital Assets Manager hasta la versión 6.5SP6, Documentum Web Publishers hasta la versión 6.5SP7 y Documentum Task Space hasta la versión 6.7SP2, permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios. NOTA: esta vulnerabilidad existe debido a una solución incompleta de la vulnerabilidad CVE-2014-2518."
    }
  ],
  "lastModified": "2026-06-17T00:27:30.270",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:emc:documentum_administrator:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C0F3BD69-53DE-4F10-ABFA-33B423A74C9E",
              "versionEndIncluding": "7.2"
            },
            {
              "criteria": "cpe:2.3:a:emc:documentum_digital_asset_manager:*:sp6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2EB25D60-1424-422A-959C-9C1D670F6155",
              "versionEndIncluding": "6.5"
            },
            {
              "criteria": "cpe:2.3:a:emc:documentum_taskspace:*:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3270E32-E010-4E39-8E9E-6B05AAC89492",
              "versionEndIncluding": "6.7"
            },
            {
              "criteria": "cpe:2.3:a:emc:documentum_web_publisher:*:sp7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE6BEA80-2CBE-4A46-97D5-ABD5EF47207C",
              "versionEndIncluding": "6.5"
            },
            {
              "criteria": "cpe:2.3:a:emc:documentum_webtop:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D66CB470-DF43-4995-842D-AAB3B259976F",
              "versionEndIncluding": "6.8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}