CVE-2015-0532
Summary
| CVE | CVE-2015-0532 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2015-05-01 10:59:00 UTC |
| Updated | 2016-04-01 01:05:00 UTC |
| Description | EMC RSA Identity Management and Governance (IMG) 6.9 before P04 and 6.9.1 before P01 does not properly restrict password resets, which allows remote attackers to obtain access via crafted use of the reset process for an arbitrary valid account name, as demonstrated by a privileged account. |
Risk And Classification
Problem Types: CWE-264
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Emc | Rsa Identity Management And Governance | 6.9.0 | All | All | All |
| Application | Emc | Rsa Identity Management And Governance | 6.9.1 | All | All | All |
| Application | Emc | Rsa Identity Management And Governance | 6.9.0 | All | All | All |
| Application | Emc | Rsa Identity Management And Governance | 6.9.1 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| RSA Identity Management and Governance Password Reset Weakness Lets Remote Users Gain Privileged Access - SecurityTracker | SECTRACK | www.securitytracker.com | |
| Bugtraq: ESA-2015-078: RSA® Identity Management and Governance (I MG) Insecure Password Reset Vulnerability | BUGTRAQ | seclists.org | |
| RSA IMG 6.9 / 6.9.1 Insecure Password Reset ≈ Packet Storm | MISC | packetstormsecurity.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.