Login Request a demo
Unscored severity · published Feb 14, 2015
CVE-2015-0517
The D2-API component in EMC Documentum D2 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 places the MD5 hash of an encryption passphrase in log files, which…
–
CVSS
1.2%
EPSS
No
On KEV
Description
The D2-API component in EMC Documentum D2 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 places the MD5 hash of an encryption passphrase in log files, which allows remote authenticated users to obtain sensitive information by reading a file.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DD
Documentum D2 · Emc
3.1; 3.1; 4.0; 4.1; 4.2 · source: NVD
Affected product
DD
Documentum D2
Emc
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0517
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0517
Broken Link
http://archives.neohapsis.com/archives/bugtraq/2015-02/0031.html
Third Party Advisory
http://www.securityfocus.com/bid/72501
Third Party Advisory
http://www.securitytracker.com/id/1031693
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/100874
More from Documentum D2
8.8
CVE-2016-0888
EMC Documentum D2 before 4.6 lacks intended ACLs for configuration objects, which allows remote authenticated users to modify objects via unspecified vectors
6.3
CVE-2016-9873
EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has a DQL Injection Vulnerability that could potentially be exploited by malicious users to compromise the affected…
6.1
CVE-2016-9872
EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has Reflected Cross-Site Scripting Vulnerabilities that could potentially be exploited by malicious users to…
5.3
CVE-2016-6644
EMC Documentum D2 4.5 before patch 15 and 4.6 before patch 03 allows remote attackers to read arbitrary Docbase documents by leveraging knowledge of an r_object_id value
–
CVE-2015-4537
Lockbox in EMC Documentum D2 before 4.5 uses a hardcoded passphrase when a server lacks a D2.Lockbox file, which makes it easier for remote authenticated users to decrypt admin…