Unscored severity · published May 24, 2011
CVE-2011-1424
The default configuration of ExShortcut\Web.config in EMC SourceOne Email Management before 6.6 SP1, when the Mobile Services component is used, does not properly set the…
–
CVSS
0.8%
EPSS
No
On KEV
Description
The default configuration of ExShortcut\Web.config in EMC SourceOne Email Management before 6.6 SP1, when the Mobile Services component is used, does not properly set the localOnly attribute of the trace element, which allows remote authenticated users to obtain sensitive information via ASP.NET Application Tracing.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Sourceone Email Management · Emc
through 6.6.0.1209; 6.5.2.3668; through 6.6.0.1209; 6.5.2.3668 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1424
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1424
securityreason.com
http://securityreason.com/securityalert/8258
www.securityfocus.com
http://www.securityfocus.com/archive/1/518003/100/0/threaded
More from Sourceone Email Management
–
CVE-2015-0531
EMC SourceOne Email Management before 7.2 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a…
–
CVE-2011-4142
The Web Search feature in EMC SourceOne Email Management 6.5 before 6.5.2.4033, 6.6 before 6.6.1.2194, and 6.7 before 6.7.2.2033 places cleartext credentials in log files, which…