Login Request a demo
Unscored severity · published Apr 1, 2014
CVE-2014-0635
Session fixation vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote attackers to hijack web sessions via unspecified vectors
–
CVSS
1.2%
EPSS
No
On KEV
Description
Session fixation vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote attackers to hijack web sessions via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VG
Vplex Geosynchrony · Emc
4.0; 5.0; 5.1; 5.2; 5.2.1 · source: NVD
Affected product
VG
Vplex Geosynchrony
Emc
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0635
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0635
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2014-03/0157.html
More from Vplex Geosynchrony
8.4
CVE-2015-6850
EMC VPLEX GeoSynchrony 5.4 SP1 before P3 and 5.5 before Patch 1 has a default password for the root account, which allows local users to gain privileges by leveraging a login…
–
CVE-2015-6847
The default configuration of EMC VPLEX GeoSynchrony 5.4 SP1 before P3 stores cleartext NAVISPHERE GUI passwords in a log file, which allows local users to obtain sensitive…
–
CVE-2014-0634
EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie, which makes it easier for remote attackers to…
–
CVE-2014-0633
The GUI in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not properly validate session-timeout values, which might make it easier for remote attackers to execute arbitrary…
–
CVE-2014-0632
Directory traversal vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote authenticated users to execute arbitrary code via unspecified vectors