CVE-2017-15013
HighSummary
OpenText Documentum Content Server up to version 7.3 contains a design gap that allows an authenticated user to gain superuser privileges. Users can edit dmr_content objects, enabling them to replace the content of security-sensitive dmr_content objects.
Risk Assessment
This vulnerability poses a serious risk to organizations as it allows unauthorized users to gain access to sensitive data and system functions.
Recommendation
It is recommended to upgrade OpenText Documentum Content Server to the latest version to mitigate this vulnerability and restrict user permissions for editing dmr_content objects.
Other vulnerabilities in OpenText Documentum Content Server
See all- CVE-2017-15276High
OpenText Documentum Content Server up to version 7.3 contains a design gap that allows an authenticated user to gain superuser privileges. The issue arises from the failure to verify the contents of TAR archives during unpacking, leading to a path traversal vulnerability via symlinks.
- CVE-2017-15012High
OpenText Documentum Content Server versions up to 7.3 improperly validate the input of the PUT_FILE RPC command, allowing any authenticated user to hijack an arbitrary file from the Content Server filesystem. Since some files are security-sensitive, this leads to privilege escalation.
- CVE-2017-7221High
OpenText Documentum Content Server has an inadequate protection mechanism against SQL injection, allowing remote authenticated users to execute arbitrary code with super-user privileges. This is exploited through the dm_bp_transition method and a user-created dm_procedure object.
- CVE-2017-7220High
OpenText Documentum Content Server allows superuser access via sys_obj_save or save of a crafted object, followed by an unauthorized 'UPDATE dm_dbo.dm_user_s SET user_privileges=16' command, known as an 'RPC save-commands' attack.
- CVE-2017-5585High
Vulnerability in OpenText Documentum Content Server 7.3, when using PostgreSQL Database and the return_top_results_row_based config option is set to false, allows improper restriction of DQL hints. This enables remote authenticated users to conduct DQL injection attacks and execute arbitrary DML or DDL commands via a crafted request.
Original NVD description (English source)
OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows an authenticated user to gain superuser privileges: Content Server stores information about uploaded files in dmr_content objects, which are queryable and "editable" (before release 7.2P02, any authenticated user was able to edit dmr_content objects; now any authenticated user may delete a dmr_content object and then create a new one with the old identifier) by authenticated users; this allows any authenticated user to replace the content of security-sensitive dmr_content objects (for example, dmr_content related to dm_method objects) and gain superuser privileges.