CVE-2017-14757
HighSummary
OpenText Document Sciences xPression version 4.5SP1 Patch 13 (older versions may also be affected) is prone to SQL Injection in the jobRunId parameter at /xDashboard/html/jobhistory/downloadSupportFile.action. An attacker must authenticate to the application first to exploit this vulnerability.
Risk Assessment
This vulnerability could lead to unauthorized access to database information, posing a serious threat to the integrity and confidentiality of organizational data.
Recommendation
It is recommended to update to the latest version of the software and to monitor logs for potential SQL Injection attack attempts.
Other vulnerabilities in OpenText Document Sciences xPression v4.5SP1 Patch 13
See all- CVE-2017-14758High
OpenText Document Sciences xPression version 4.5SP1 Patch 13 (older versions may also be affected) is prone to SQL Injection in the documentId parameter on the /xAdmin/html/cm_doclist_view_uc.jsp page. To exploit this vulnerability, an attacker must first authenticate to the application.
- CVE-2017-14759Critical
OpenText Document Sciences xPression version 4.5SP1 Patch 13 (older versions might also be affected) has an XML External Entity vulnerability. An unauthenticated user can read directory listings or system files, or cause SSRF or Denial of Service.
Original NVD description (English source)
OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to SQL Injection: /xDashboard/html/jobhistory/downloadSupportFile.action, parameter: jobRunId. In order for this vulnerability to be exploited, an attacker must authenticate to the application first.