EMC Documentum D2 < 4.1 P22 / 4.2 P11 Multiple Vulnerabilities (ESA-2015-010)

Medium Nessus Plugin ID 81342


The remote host is affected by multiple vulnerabilities.


The remote host is running a version EMC Documentum D2 prior to 4.1 P22 / 4.2 P11. It is, therefore, affected by multiple vulnerabilities :

- An information disclosure vulnerability exists due to the D2-API component logging the MD5 hash of the passphrase used to encrypt sensitive information and user credentials. A remote, authenticated attacker can recover the passphrase. (CVE-2015-0517)

- A privilege escalation vulnerability exists due to a flaw in the D2FS web service component that allows a remote, authenticated attacker to manipulate group permissions and obtain superuser privileges.


Upgrade to EMC Documentum D2 4.1 P22 / 4.2 P11 or later.

See Also


Plugin Details

Severity: Medium

ID: 81342

File Name: emc_documentum_d2_ESA-2015-010.nasl

Version: $Revision: 1.5 $

Type: remote

Family: Misc.

Published: 2015/02/13

Modified: 2015/07/07

Dependencies: 77303

Risk Information

Risk Factor: Medium


Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:emc:documentum_d2

Required KB Items: installed_sw/EMC Documentum D2

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2015/02/04

Vulnerability Publication Date: 2015/02/04

Reference Information

CVE: CVE-2015-0517, CVE-2015-0518

BID: 72501, 72502

OSVDB: 117938, 117939