Unscored severity · published Jan 7, 2015
CVE-2014-4636
Cross-site request forgery (CSRF) vulnerability in EMC Documentum Web Development Kit (WDK) before 6.8 allows remote attackers to hijack the authentication of arbitrary users for…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in EMC Documentum Web Development Kit (WDK) before 6.8 allows remote attackers to hijack the authentication of arbitrary users for requests that perform Docbase operations.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DW
Documentum Wdk · Emc
through 6.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-4636
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-4636
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2015-01/0009.html
packetstormsecurity.com
http://packetstormsecurity.com/files/129822/EMC-Documentum-Web-Development-Kit-XSS-CSRF-Redirection-Injection.html
www.securitytracker.com
http://www.securitytracker.com/id/1031497
More from Documentum Wdk
–
CVE-2014-4639
EMC Documentum Web Development Kit (WDK) before 6.8 does not properly generate random numbers for a certain parameter related to Webtop components, which makes it easier for…
–
CVE-2014-4638
EMC Documentum Web Development Kit (WDK) before 6.8 allows remote attackers to conduct frame-injection attacks and obtain sensitive information via unspecified vectors
–
CVE-2014-4637
Open redirect vulnerability in EMC Documentum Web Development Kit (WDK) before 6.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks…
–
CVE-2014-4635
Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum Web Development Kit (WDK) before 6.8 allow remote attackers to inject arbitrary web script or HTML via…
–
CVE-2014-2518
Multiple cross-site request forgery (CSRF) vulnerabilities in EMC Documentum WDK before 6.7SP1 P28 and 6.7SP2 before P15 allow remote attackers to hijack the authentication of…