Information disclosure in EMC Documentum D2

CVE-2015-0517

The D2-API component in EMC Documentum D2 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 places the MD5 hash of an encryption passphrase in log files, which allows remote authenticated users to obtain sensitive information by reading a file.

Vulnerability class: Information Disclosure

EPSS: 0.012 (65.8th percentile) — read the EPSS interpretation.

Affected products

Emc Documentum_d2 — versions 3.1, 4.0, 4.1
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

security_alert@emc.com (vdb-entry, x_refsource_XF)
security_alert@emc.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
security_alert@emc.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
security_alert@emc.com (mailing-list, x_refsource_BUGTRAQ, Broken Link)