Unscored severity · published Oct 18, 2015
CVE-2015-6845
EMC SourceOne Email Supervisor before 7.2 does not properly employ random values for session IDs, which makes it easier for remote attackers to obtain access by guessing an ID
–
CVSS
3.5%
EPSS
No
On KEV
Description
EMC SourceOne Email Supervisor before 7.2 does not properly employ random values for session IDs, which makes it easier for remote attackers to obtain access by guessing an ID.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Sourceone Email Supervisor · Emc
through 7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-6845
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-6845
Third Party Advisory
http://packetstormsecurity.com/files/133922/EMC-SourceOne-Email-Supervisor-XSS-Session-Hijacking.html
Mailing List
http://seclists.org/bugtraq/2015/Oct/58
Third Party Advisory
http://www.securitytracker.com/id/1033787
More from Sourceone Email Supervisor
–
CVE-2015-6846
EMC SourceOne Email Supervisor before 7.2 uses hardcoded encryption keys, which makes it easier for attackers to obtain access by examining how a program's code conducts…
–
CVE-2015-6844
Cross-site scripting (XSS) vulnerability in Reviewer in EMC SourceOne Email Supervisor before 7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified…
–
CVE-2015-6843
Reviewer in EMC SourceOne Email Supervisor before 7.2 does not properly limit attempts to authenticate, which makes it easier for remote attackers to obtain access via a…