CVE-2015-4537

{"id": "CVE-2015-4537", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-08-22T18:59:02.280", "references": [{"url": "http://seclists.org/bugtraq/2015/Aug/117", "source": "security_alert@emc.com"}, {"url": "http://www.securitytracker.com/id/1033345", "source": "security_alert@emc.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Lockbox in EMC Documentum D2 before 4.5 uses a hardcoded passphrase when a server lacks a D2.Lockbox file, which makes it easier for remote authenticated users to decrypt admin tickets by locating this passphrase in a decompiled D2 JAR archive."}, {"lang": "es", "value": "Vulnerabilidad en Lockbox en EMC Documentum D2 anterior a 4.5, utiliza una frase de acceso embebida cuando a un servidor le falta el fichero D2.Lockbox, lo que hace que sea m\u00e1s f\u00e1cil para los usuarios remotos autenticados descifrar tickets de administraci\u00f3n mediante la localizaci\u00f3n de esta frase de acceso en un archivo D2 JAR descompilado."}], "lastModified": "2016-12-24T02:59:19.243", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:emc:documentum_d2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DCFDBE2F-7E8A-4112-8A4B-AA43693EABE3", "versionEndIncluding": "4.4"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}