Unscored severity · published Jul 4, 2015
CVE-2015-4524
Unrestricted file upload vulnerability in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before…
–
CVSS
2.4%
EPSS
No
On KEV
Description
Unrestricted file upload vulnerability in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before P23, 7.0 before P18, 7.1 before P15, and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before P25; Documentum Web Publishers 6.5 SP7 before P25; and Documentum Task Space 6.7SP1 before P31 and 6.7SP2 before P23 allows remote authenticated users to execute arbitrary code by uploading a file to the backend Content Server.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
Documentum Administrator · Emc
6.7; 6.7; 7.0; 7.1; 7.2 · source: NVD
DD
Documentum Digital Asset Manager · Emc
6.5 · source: NVD
DT
Documentum Taskspace · Emc
6.7; 6.7 · source: NVD
DW
Documentum Web Publisher · Emc
6.5 · source: NVD
DW
Documentum Webtop · Emc
6.7; 6.7; 6.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-4524
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-4524
Mailing List
http://seclists.org/bugtraq/2015/Jul/9
Third Party Advisory
http://www.securitytracker.com/id/1032770
More from Documentum Administrator
6.3
CVE-2016-0914
EMC Documentum WebTop 6.8 before Patch 13 and 6.8.1 before Patch 02, Documentum Administrator 7.x before 7.2 Patch 13, Documentum Capital Projects 1.9 before Patch 23 and 1.10…
6.1
CVE-2016-8213
EMC Documentum WebTop Version 6.8, prior to P18 and Version 6.8.1, prior to P06; and EMC Documentum TaskSpace version 6.7SP3, prior to P02; and EMC Documentum Capital Projects…
–
CVE-2015-4530
Cross-site request forgery (CSRF) vulnerability in EMC Documentum WebTop before 6.8P01, Documentum Administrator through 7.2, Documentum Digital Assets Manager through 6.5SP6,…
–
CVE-2015-4529
Open redirect vulnerability in EMC Documentum WebTop before 6.8P02, Documentum Administrator before 7.2P01, Documentum Digital Assets Manager through 6.5SP6, Documentum Web…
–
CVE-2015-0551
Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31,…