Unscored severity · published Mar 12, 2015
CVE-2015-0524
SQL injection vulnerability in the Gateway Provisioning service in EMC Secure Remote Services Virtual Edition (ESRS VE) 3.02 and 3.03 allows remote attackers to execute arbitrary…
–
CVSS
2.1%
EPSS
No
On KEV
Description
SQL injection vulnerability in the Gateway Provisioning service in EMC Secure Remote Services Virtual Edition (ESRS VE) 3.02 and 3.03 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SR
Secure Remote Services · Emc
3.02; 3.03 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0524
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0524
packetstormsecurity.com
http://packetstormsecurity.com/files/130768/EMC-Secure-Remote-Services-GHOST-SQL-Injection-Command-Injection.html
seclists.org
http://seclists.org/bugtraq/2015/Mar/40
seclists.org
http://seclists.org/fulldisclosure/2015/Mar/119
www.securityfocus.com
http://www.securityfocus.com/archive/1/534930/100/0/threaded
Exploit
https://www.securify.nl/advisory/SFY20141113/emc_secure_remote_services_virtual_edition_provisioning_component_is_affected_by_sql_injection.html
More from Secure Remote Services
7.8
CVE-2018-11080
Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains Improper File Permission Vulnerabilities
7.8
CVE-2018-11079
Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability
5.3
CVE-2017-4986
EMC ESRS VE 3.18 or earlier contains Authentication Bypass that could potentially be exploited by malicious users to compromise the affected system
4.3
CVE-2015-6852
Directory traversal vulnerability in the API in EMC Secure Remote Services Virtual Edition 3.x before 3.10 allows remote authenticated users to read log files via a crafted…
–
CVE-2015-0544
EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to…