CVE-2015-0518
The Properties service in the D2FS web-service component in EMC Documentum D2 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 allows remote authenticated users to obtain superuser privileges via an unspecified method call that modifies…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.66%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The Properties service in the D2FS web-service component in EMC Documentum D2 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 allows remote authenticated users to obtain superuser privileges via an unspecified method call that modifies group permissions.
- CVSS 2.0
- 9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C
- EPSS
- 3.66% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- emc/documentum d2
- Source
- security_alert@emc.com
References
- http://archives.neohapsis.com/archives/bugtraq/2015-02/0031.htmlBroken Link
- http://www.securityfocus.com/bid/72502Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1031693Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100875
- http://archives.neohapsis.com/archives/bugtraq/2015-02/0031.htmlBroken Link
- http://www.securityfocus.com/bid/72502Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1031693Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100875
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.