CVE-2015-4537 Lockbox in EMC Documentum D2 before 4.5 uses a hardcoded passphrase when a server lacks a D2.Lockbox file, which makes it easier for remote authenticated users to decrypt admin tickets by locating thi...
LowCVSS 3.5
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Lockbox in EMC Documentum D2 before 4.5 uses a hardcoded passphrase when a server lacks a D2.Lockbox file, which makes it easier for remote authenticated users to decrypt admin tickets by locating this passphrase in a decompiled D2 JAR archive.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| emc documentum d2 | <= 4.4 | No fix listed |
References
- 20150820 ESA-2015-132: EMC Documentum D2 Fail Open Vulnerability mailing-list
- 1033345 vdb-entry