#VU41869 Improper Authentication in VPLEX GeoSynchrony - CVE-2014-0635

Vulnerability identifier: #VU41869

Vulnerability risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2014-0635

CWE-ID: CWE-287

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
VPLEX GeoSynchrony
Server applications / Virtualization software

Vendor: Dell

Description

The vulnerability allows a remote #AU# to read, manipulate or delete data.

Session fixation vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote attackers to hijack web sessions via unspecified vectors.

Mitigation
Install update from vendor's website.

Vulnerable software versions

VPLEX GeoSynchrony: 4.0 - 5.2.1

---

External links
https://archives.neohapsis.com/archives/bugtraq/2014-03/0157.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.