Improper input validation in Emc Secure Remote Services

CVE-2015-0543

EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.007 (48.3th percentile) — read the EPSS interpretation.

Affected products

Emc Secure_remote_services — versions 3.02, 3.03, 3.04
N/a — versions n/a

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

security_alert@emc.com (vdb-entry, x_refsource_SECTRACK)
security_alert@emc.com (mailing-list, x_refsource_BUGTRAQ)