CVE-2014-4618

EMC Documentum Content Server before 7.1P20 and 7.2.x before 7.2P04 does not properly verify authorization for dm_job object access, allowing remote authenticated users to obtain superuser privileges via crafted object operations.

In Java Method Server (JMS) in EMC Documentum Content Server before versions 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02, when __debug_trace__ is configured, remote authenticated users can gain super-user privileges by leveraging the ability to read a log file containing a login ticket.

Java Method Server (JMS) in EMC Documentum Content Server before version 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 allows remote authenticated users to execute arbitrary code by forging a signature for a query string that lacks the method_verb parameter.

EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 does not properly check authorization after creation of an object, allowing remote authenticated users to execute arbitrary code with super-user privileges via a custom script.

EMC Documentum Content Server before version 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 does not properly check authorization and does not restrict object types, allowing remote authenticated users to run save RPC commands with super-user privileges and execute arbitrary code.

EMC Documentum Content Server before version 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 does not properly check authorization for subgroups of privileged groups, allowing remote authenticated sysadmins to gain super-user privileges and bypass intended restrictions on data access and server actions.

The vulnerability in EMC Documentum Content Server before version 6.7 SP1 P29, 6.7 SP2 before P18, 7.0 before P16, and 7.1 before P09 allows remote authenticated users to gain privileges by manipulating dm_job and dm_job_request objects.

EMC Documentum Content Server versions 7.0, 7.1 before 7.1 P10, and 6.7 before SP2 P19 allow remote authenticated users to read or delete arbitrary files via unspecified vectors related to an insecure direct object reference.

EMC Documentum Content Server before version 6.7 SP2 P17, 7.0 through P15, and 7.1 before P08 does not properly check authorization for subgroups of privileged groups. This allows remote authenticated sysadmins to gain super-user privileges and bypass intended restrictions on data access and server actions.

EMC Documentum Content Server before version 6.7 SP2 P17, 7.0 through P15, and 7.1 before P08 does not properly check authorization for subtypes of protected system types. This allows remote authenticated users to obtain super-user privileges for system-object creation and bypass intended restrictions on data access and server actions.