CVE-2017-14758
HighSummary
OpenText Document Sciences xPression version 4.5SP1 Patch 13 (older versions may also be affected) is prone to SQL Injection in the documentId parameter on the /xAdmin/html/cm_doclist_view_uc.jsp page. To exploit this vulnerability, an attacker must first authenticate to the application.
Risk Assessment
This vulnerability may lead to unauthorized access to database data, potentially resulting in the leakage of sensitive information. Organizations should be aware of the risks associated with unauthorized data access.
Recommendation
It is recommended to update to the latest version of the software and implement additional security measures such as log monitoring and access restrictions to the application.
Other vulnerabilities in OpenText Document Sciences xPression v4.5SP1 Patch 13
See all- CVE-2017-14757High
OpenText Document Sciences xPression version 4.5SP1 Patch 13 (older versions may also be affected) is prone to SQL Injection in the jobRunId parameter at /xDashboard/html/jobhistory/downloadSupportFile.action. An attacker must authenticate to the application first to exploit this vulnerability.
- CVE-2017-14759Critical
OpenText Document Sciences xPression version 4.5SP1 Patch 13 (older versions might also be affected) has an XML External Entity vulnerability. An unauthenticated user can read directory listings or system files, or cause SSRF or Denial of Service.
Original NVD description (English source)
OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to SQL Injection: /xAdmin/html/cm_doclist_view_uc.jsp, parameter: documentId. In order for this vulnerability to be exploited, an attacker must authenticate to the application first.