CVE-2016-0888 Missing authorization in n/a
Remote authenticated users can modify configuration objects due to missing access controls in EMC Documentum D2.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-0888?
CVE-2016-0888 is a high-severity missing authorization vulnerability in n/a, published on 7 Apr 2016. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
EMC Documentum D2 before 4.6 lacks intended ACLs for configuration objects, which allows remote authenticated users to modify objects via unspecified vectors.
Which versions are affected by CVE-2016-0888?
It affects 1 product.
Products include Emc Documentum D2.
How do I fix CVE-2016-0888?
No fix has been published for CVE-2016-0888 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2016-0888 being exploited?
There is no known exploitation of CVE-2016-0888 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2015-0518 Privilege escalation in n/a
- CVE-2014-2504 Missing authorization in n/a
- CVE-2014-2515 Privilege escalation in n/a
- CVE-2016-9873 SQL injection in EMC Documentum D2 EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6
- CVE-2016-9872 Cross-site scripting in EMC Documentum D2 EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6
Sources
Also known as GHSA-rx47-c6vv-q4gw.