CVE-2017-14526

Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Administrator 7.2.0180.0055 allow remote authenticated users to list the contents of arbitrary directories, read arbitrary files, cause a denial of service, or, on Windows, obtain Documentum user hashes via a (1) crafted DTD, involving unspecified XML structures in a request to xda/com/documentum/ucf/server/transport/impl/GAIRConnector or crafted XML file in a MediaProfile file (2) import or (3) check in.

CVSS v3 8.8 HIGH
CVSS v2.0 6.5 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://seclists.org/fulldisclosure/2017/Sep/58	Mailing List Third Party Advisory
https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774	Permissions Required Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:opentext:documentum_administrator:7.2.0180.0055:::::::*
	cpe:2.3:a:opentext:documentum_webtop:6.8.0160.0073:::::::*

History

No history.

Information

Published : 2017-09-28 01:29

Updated : 2017-10-06 15:30

NVD link : CVE-2017-14526

Mitre link : CVE-2017-14526

CVE.ORG link : CVE-2017-14526

JSON object : View

Products Affected

opentext

documentum_administrator
documentum_webtop

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2017-14526", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2017-09-28T01:29:01.543", "references": [{"url": "http://seclists.org/fulldisclosure/2017/Sep/58", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774", "tags": ["Permissions Required", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Administrator 7.2.0180.0055 allow remote authenticated users to list the contents of arbitrary directories, read arbitrary files, cause a denial of service, or, on Windows, obtain Documentum user hashes via a (1) crafted DTD, involving unspecified XML structures in a request to xda/com/documentum/ucf/server/transport/impl/GAIRConnector or crafted XML file in a MediaProfile file (2) import or (3) check in."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de XEE (XML External Entity) en la versi\u00f3n 7.2.0180.0055 de OpenText Documentum Administrator permiten que los usuarios autenticados remotos listen el contenido de directorios remotos, lean archivos arbitrarios, provoquen una denegaci\u00f3n de servicio o, en Windows, obtengan hashes de usuario de Documentum mediante (1) un archivo DTD manipulado, que involucra estructuras XML sin especificar en una petici\u00f3n a xda/com/documentum/ucf/server/transport/impl/GAIRConnector o un archivo XML manipulado en un archivo MediaProfile (2) importado o (3) insertado en el repositorio."}], "lastModified": "2017-10-06T15:30:22.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opentext:documentum_administrator:7.2.0180.0055:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEEBDA29-6EC7-4E2D-A74A-3967AE2C6458"}, {"criteria": "cpe:2.3:a:opentext:documentum_webtop:6.8.0160.0073:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C082233-5926-436C-B55D-99349345A9F7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}