{"api_version":"1","generated_at":"2026-07-23T08:26:28+00:00","cve":"CVE-2015-2864","urls":{"html":"https://cve.report/CVE-2015-2864","api":"https://cve.report/api/cve/CVE-2015-2864.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-2864","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-2864"},"summary":{"title":"CVE-2015-2864","description":"Retrospect and Retrospect Client before 10.0.2.119 on Windows, before 12.0.2.116 on OS X, and before 10.0.2.104 on Linux improperly generate password hashes, which makes it easier for remote attackers to bypass authentication and obtain access to backup files by leveraging a collision.","state":"PUBLISHED","assigner":"certcc","published_at":"2015-09-21 10:59:00","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-255","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/75201","name":"http://www.securityfocus.com/bid/75201","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Retrospect Backup Client CVE-2015-2864 Weak Password Security Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securitytracker.com/id/1033948","name":"http://www.securitytracker.com/id/1033948","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Retrospect Password Hashing Error Lets Remote Users Access Files on the Target System - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.kb.cert.org/vuls/id/101500","name":"http://www.kb.cert.org/vuls/id/101500","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"],"title":"Vulnerability Note VU#101500 - Retrospect Backup Client uses weak password hashing","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.retrospect.com/support/kb/cve_2015_2864","name":"http://www.retrospect.com/support/kb/cve_2015_2864","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Retrospect: Knowledge Base > CERT Vulnerability CVE-2015-2864","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.youtube.com/watch?v=MB8AL5u7JCA","name":"https://www.youtube.com/watch?v=MB8AL5u7JCA","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"HIP14-Fuzzing reversing and maths - YouTube","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-2864","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2864","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"2864","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"retrospect","cpe5":"retrospect","cpe6":"10.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"windows","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"2864","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"retrospect","cpe5":"retrospect","cpe6":"12.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"mac","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"2864","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"retrospect","cpe5":"retrospect_client","cpe6":"10.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"linux","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"2864","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"retrospect","cpe5":"retrospect_client","cpe6":"10.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"windows","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"2864","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"retrospect","cpe5":"retrospect_client","cpe6":"12.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"mac","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T05:32:19.793Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"VU#101500","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"],"url":"http://www.kb.cert.org/vuls/id/101500"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.retrospect.com/support/kb/cve_2015_2864"},{"name":"75201","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/75201"},{"name":"1033948","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1033948"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://www.youtube.com/watch?v=MB8AL5u7JCA"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-06-15T00:00:00.000Z","descriptions":[{"lang":"en","value":"Retrospect and Retrospect Client before 10.0.2.119 on Windows, before 12.0.2.116 on OS X, and before 10.0.2.104 on Linux improperly generate password hashes, which makes it easier for remote attackers to bypass authentication and obtain access to backup files by leveraging a collision."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-12-05T21:57:02.000Z","orgId":"37e5125f-f79b-445b-8fad-9564f167944b","shortName":"certcc"},"references":[{"name":"VU#101500","tags":["third-party-advisory","x_refsource_CERT-VN"],"url":"http://www.kb.cert.org/vuls/id/101500"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.retrospect.com/support/kb/cve_2015_2864"},{"name":"75201","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/75201"},{"name":"1033948","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1033948"},{"tags":["x_refsource_MISC"],"url":"https://www.youtube.com/watch?v=MB8AL5u7JCA"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cert@cert.org","ID":"CVE-2015-2864","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Retrospect and Retrospect Client before 10.0.2.119 on Windows, before 12.0.2.116 on OS X, and before 10.0.2.104 on Linux improperly generate password hashes, which makes it easier for remote attackers to bypass authentication and obtain access to backup files by leveraging a collision."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"VU#101500","refsource":"CERT-VN","url":"http://www.kb.cert.org/vuls/id/101500"},{"name":"http://www.retrospect.com/support/kb/cve_2015_2864","refsource":"CONFIRM","url":"http://www.retrospect.com/support/kb/cve_2015_2864"},{"name":"75201","refsource":"BID","url":"http://www.securityfocus.com/bid/75201"},{"name":"1033948","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1033948"},{"name":"https://www.youtube.com/watch?v=MB8AL5u7JCA","refsource":"MISC","url":"https://www.youtube.com/watch?v=MB8AL5u7JCA"}]}}}},"cveMetadata":{"assignerOrgId":"37e5125f-f79b-445b-8fad-9564f167944b","assignerShortName":"certcc","cveId":"CVE-2015-2864","datePublished":"2015-09-21T10:00:00.000Z","dateReserved":"2015-04-03T00:00:00.000Z","dateUpdated":"2024-08-06T05:32:19.793Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-09-21 10:59:00","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-255","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:retrospect:retrospect:10.0.2:*:*:*:*:windows:*:*","matchCriteriaId":"F0D942BA-5CB8-4428-B9F9-477CEF95F305"},{"vulnerable":true,"criteria":"cpe:2.3:a:retrospect:retrospect:12.0.2:*:*:*:*:mac:*:*","matchCriteriaId":"F0D24914-4CFC-4308-ABCE-41257B297481"},{"vulnerable":true,"criteria":"cpe:2.3:a:retrospect:retrospect_client:10.0.2:*:*:*:*:linux:*:*","matchCriteriaId":"67779501-A19B-41A9-92C9-DE01072EB5A6"},{"vulnerable":true,"criteria":"cpe:2.3:a:retrospect:retrospect_client:10.0.2:*:*:*:*:windows:*:*","matchCriteriaId":"584D8E51-0FA8-45CB-B982-40F5B0AB36C8"},{"vulnerable":true,"criteria":"cpe:2.3:a:retrospect:retrospect_client:12.0.2:*:*:*:*:mac:*:*","matchCriteriaId":"CEF6B991-A24F-48BF-BFEC-A592A04A8619"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"2864","Ordinal":"1","Title":"CVE-2015-2864","CVE":"CVE-2015-2864","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"2864","Ordinal":"1","NoteData":"Retrospect and Retrospect Client before 10.0.2.119 on Windows, before 12.0.2.116 on OS X, and before 10.0.2.104 on Linux improperly generate password hashes, which makes it easier for remote attackers to bypass authentication and obtain access to backup files by leveraging a collision.","Type":"Description","Title":"CVE-2015-2864"},{"CveYear":"2015","CveId":"2864","Ordinal":"2","NoteData":"2015-09-21","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"2864","Ordinal":"3","NoteData":"2016-12-05","Type":"Other","Title":"Modified"}]}}}