High severity · published Sep 28, 2017
CVE-2017-14526
Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Administrator 7.2.0180.0055 allow remote authenticated users to list the contents of arbitrary…
8.8
CVSS
1.2%
EPSS
No
On KEV
Description
Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Administrator 7.2.0180.0055 allow remote authenticated users to list the contents of arbitrary directories, read arbitrary files, cause a denial of service, or, on Windows, obtain Documentum user hashes via a (1) crafted DTD, involving unspecified XML structures in a request to xda/com/documentum/ucf/server/transport/impl/GAIRConnector or crafted XML file in a MediaProfile file (2) import or (3) check in.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
Documentum Administrator · Opentext
7.2.0180.0055 · source: NVD
DW
Documentum Webtop · Opentext
6.8.0160.0073 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-14526
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-14526
Mailing List
http://seclists.org/fulldisclosure/2017/Sep/58
Permissions Required
https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774
More from Documentum Administrator
8.8
CVE-2017-14527
Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Webtop 6.8.0160.0073 allow remote authenticated users to list the contents of arbitrary directories,…
6.1
CVE-2017-14525
Multiple open redirect vulnerabilities in OpenText Documentum Webtop 6.8.0160.0073 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via…
6.1
CVE-2017-14524
Multiple open redirect vulnerabilities in OpenText Documentum Administrator 7.2.0180.0055 allow remote attackers to redirect users to arbitrary web sites and conduct phishing…