Unscored severity · published Jul 5, 2015
CVE-2015-0544
EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to…
–
CVSS
2.5%
EPSS
No
On KEV
Description
EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SR
Secure Remote Services · Emc
3.02; 3.03; 3.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0544
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0544
seclists.org
http://seclists.org/bugtraq/2015/Jun/132
www.securitytracker.com
http://www.securitytracker.com/id/1032740
More from Secure Remote Services
7.8
CVE-2018-11080
Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains Improper File Permission Vulnerabilities
7.8
CVE-2018-11079
Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability
5.3
CVE-2017-4986
EMC ESRS VE 3.18 or earlier contains Authentication Bypass that could potentially be exploited by malicious users to compromise the affected system
4.3
CVE-2015-6852
Directory traversal vulnerability in the API in EMC Secure Remote Services Virtual Edition 3.x before 3.10 allows remote authenticated users to read log files via a crafted…
–
CVE-2015-0543
EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to…