CVE-2015-0532

EMC RSA Identity Management and Governance (IMG) 6.9 before P04 and 6.9.1 before P01 does not properly restrict password resets, which allows remote attackers to obtain access via crafted use of the reset process for an arbitrary valid account name, as demonstrated by a privileged account.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://packetstormsecurity.com/files/131710/RSA-IMG-6.9-6.9.1-Insecure-Password-Reset.html
http://seclists.org/bugtraq/2015/Apr/204
http://www.securitytracker.com/id/1032218

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.0:::::::*
	cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1:::::::*

History

No history.

Information

Published : 2015-05-01 10:59

Updated : 2024-02-04 18:35

NVD link : CVE-2015-0532

Mitre link : CVE-2015-0532

CVE.ORG link : CVE-2015-0532

JSON object : View

Products Affected

emc

rsa_identity_management_and_governance

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2015-0532", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-05-01T10:59:00.073", "references": [{"url": "http://packetstormsecurity.com/files/131710/RSA-IMG-6.9-6.9.1-Insecure-Password-Reset.html", "source": "security_alert@emc.com"}, {"url": "http://seclists.org/bugtraq/2015/Apr/204", "source": "security_alert@emc.com"}, {"url": "http://www.securitytracker.com/id/1032218", "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "EMC RSA Identity Management and Governance (IMG) 6.9 before P04 and 6.9.1 before P01 does not properly restrict password resets, which allows remote attackers to obtain access via crafted use of the reset process for an arbitrary valid account name, as demonstrated by a privileged account."}, {"lang": "es", "value": "EMC RSA Identity Management and Governance (IMG) 6.9 anterior a P04 y 6.9.1 anterior a P01 no restringe correctamente las reconfiguraciones de contrase\u00f1as, lo que permite a atacantes remotos obtener el acceso a trav\u00e9s de el uso manipulado del proceso de reconfiguraci\u00f3n para un nombre de cuenta v\u00e1lido arbitrario, tal y como fue demostrado por una cuenta privilegiada."}], "lastModified": "2016-04-01T01:05:07.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0EFA9B3D-507A-49CD-9DA5-3CC984EE4E64"}, {"criteria": "cpe:2.3:a:emc:rsa_identity_management_and_governance:6.9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E8784E8C-B027-446D-92E3-E1FF3CA90BA2"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}