CVE-2017-15012
HighSummary
OpenText Documentum Content Server versions up to 7.3 improperly validate the input of the PUT_FILE RPC command, allowing any authenticated user to hijack an arbitrary file from the Content Server filesystem. Since some files are security-sensitive, this leads to privilege escalation.
Risk Assessment
The organization is at risk of privilege escalation by authenticated users, which may lead to unauthorized access to sensitive data.
Recommendation
It is recommended to update OpenText Documentum Content Server to the latest version to ensure proper input validation and minimize the risk of privilege escalation.
Other vulnerabilities in OpenText Documentum Content Server
See all- CVE-2017-15276High
OpenText Documentum Content Server up to version 7.3 contains a design gap that allows an authenticated user to gain superuser privileges. The issue arises from the failure to verify the contents of TAR archives during unpacking, leading to a path traversal vulnerability via symlinks.
- CVE-2017-15013High
OpenText Documentum Content Server up to version 7.3 contains a design gap that allows an authenticated user to gain superuser privileges. Users can edit dmr_content objects, enabling them to replace the content of security-sensitive dmr_content objects.
- CVE-2017-7221High
OpenText Documentum Content Server has an inadequate protection mechanism against SQL injection, allowing remote authenticated users to execute arbitrary code with super-user privileges. This is exploited through the dm_bp_transition method and a user-created dm_procedure object.
- CVE-2017-7220High
OpenText Documentum Content Server allows superuser access via sys_obj_save or save of a crafted object, followed by an unauthorized 'UPDATE dm_dbo.dm_user_s SET user_privileges=16' command, known as an 'RPC save-commands' attack.
- CVE-2017-5585High
Vulnerability in OpenText Documentum Content Server 7.3, when using PostgreSQL Database and the return_top_results_row_based config option is set to false, allows improper restriction of DQL hints. This enables remote authenticated users to conduct DQL injection attacks and execute arbitrary DML or DDL commands via a crafted request.
Original NVD description (English source)
OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 does not properly validate the input of the PUT_FILE RPC-command, which allows any authenticated user to hijack an arbitrary file from the Content Server filesystem; because some files on the Content Server filesystem are security-sensitive, this leads to privilege escalation.