CVE-2017-14527: opentext documentum_administrator

Vulnerability summary

CVE-2017-14527 is a high (CVSS 8.8) vulnerability in opentext documentum_administrator. EPSS estimates a 1.38% chance of exploitation in the next 30 days, higher than 71.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 27-09-2017
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Webtop 6.8.0160.0073 allow remote authenticated users to list the contents of arbitrary directories, read arbitrary files, cause a denial of service, or, on Windows, obtain Documentum user hashes via a (1) crafted DTD, involving unspecified XML structures in a request to xda/com/documentum/ucf/server/transport/impl/GAIRConnector or crafted XML file in a MediaProfile file (2) import or (3) check in.

• CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.