CVE-2017-14759

Critical

Published: 03/10/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

OpenText Document Sciences xPression version 4.5SP1 Patch 13 (older versions might also be affected) has an XML External Entity vulnerability. An unauthenticated user can read directory listings or system files, or cause SSRF or Denial of Service.

Risk Assessment

The organization may be exposed to unauthorized access to sensitive data and attacks that could lead to system downtime.

Recommendation

It is recommended to update to the latest version of the software and implement appropriate security measures to restrict access to critical services.

Original NVD description (English source)

OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to an XML External Entity vulnerability: /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/. An unauthenticated user is able to read directory listings or system files, or cause SSRF or Denial of Service.