Unscored severity · published Oct 18, 2015
CVE-2015-6843
Reviewer in EMC SourceOne Email Supervisor before 7.2 does not properly limit attempts to authenticate, which makes it easier for remote attackers to obtain access via a…
–
CVSS
2.9%
EPSS
No
On KEV
Description
Reviewer in EMC SourceOne Email Supervisor before 7.2 does not properly limit attempts to authenticate, which makes it easier for remote attackers to obtain access via a brute-force approach.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Sourceone Email Supervisor · Emc
through 7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-6843
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-6843
Third Party Advisory
http://packetstormsecurity.com/files/133922/EMC-SourceOne-Email-Supervisor-XSS-Session-Hijacking.html
Mailing List
http://seclists.org/bugtraq/2015/Oct/58
Third Party Advisory
http://www.securitytracker.com/id/1033787
More from Sourceone Email Supervisor
–
CVE-2015-6846
EMC SourceOne Email Supervisor before 7.2 uses hardcoded encryption keys, which makes it easier for attackers to obtain access by examining how a program's code conducts…
–
CVE-2015-6845
EMC SourceOne Email Supervisor before 7.2 does not properly employ random values for session IDs, which makes it easier for remote attackers to obtain access by guessing an ID
–
CVE-2015-6844
Cross-site scripting (XSS) vulnerability in Reviewer in EMC SourceOne Email Supervisor before 7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified…