CVE-2015-4534

2015-08-2010:59:00

CWE-20

[email protected]

web.nvd.nist.gov

cve

emc documentum content server

java method server

jms

remote code execution

signature forgery

nvd

7.4 High

AI Score

Confidence

Low

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.008 Low

EPSS

Percentile

81.2%

JSON

Java Method Server (JMS) in EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 allows remote authenticated users to execute arbitrary code by forging a signature for a query string that lacks the method_verb parameter.

CPENameOperatorVersion
emc:documentum_content_serveremc documentum content servereq6.7
emc:documentum_content_serveremc documentum content servereq7.0
emc:documentum_content_serveremc documentum content servereq7.2
emc:documentum_content_serveremc documentum content servereq7.1

CPE	Name	Operator	Version
emc:documentum_content_server	emc documentum content server	eq	6.7
emc:documentum_content_server	emc documentum content server	eq	7.0
emc:documentum_content_server	emc documentum content server	eq	7.2
emc:documentum_content_server	emc documentum content server	eq	7.1