CVE-2015-0517: Infoleak
Published Feb 14, 2015
·Updated
The D2-API component in EMC Documentum D2 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 places the MD5 hash of an encryption passphrase in log files, which allows remote authenticated users to obtain sensitive information by reading a file.
Affected Software
5 affected components
EMC Documentum D2=3.1
EMC Documentum D2=3.1-sp1
EMC Documentum D2=4.0
EMC Documentum D2=4.1
EMC Documentum D2=4.2
Event History
Feb 14, 2015
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-0517?
CVE-2015-0517 has a medium severity rating due to the exposure of sensitive information through log files.
2
How do I fix CVE-2015-0517?
To fix CVE-2015-0517, upgrade to EMC Documentum D2 version 4.1 P22 or 4.2 P11 or later.
3
What type of information is exposed in CVE-2015-0517?
CVE-2015-0517 exposes the MD5 hash of an encryption passphrase in log files.
4
Who is affected by CVE-2015-0517?
CVE-2015-0517 affects users of EMC Documentum D2 versions 3.1 through 4.1 prior to specific patches.
5
Can remote authenticated users exploit CVE-2015-0517?
Yes, remote authenticated users can exploit CVE-2015-0517 by accessing log files to obtain sensitive information.