CVE-2017-5585
HighSummary
Vulnerability in OpenText Documentum Content Server 7.3, when using PostgreSQL Database and the return_top_results_row_based config option is set to false, allows improper restriction of DQL hints. This enables remote authenticated users to conduct DQL injection attacks and execute arbitrary DML or DDL commands via a crafted request.
Risk Assessment
The organization may face serious security threats, including unauthorized access to data and the execution of dangerous operations on the database.
Recommendation
It is recommended to upgrade to the latest version of OpenText Documentum Content Server and enable the return_top_results_row_based option to minimize the risk of DQL injection attacks.
Other vulnerabilities in OpenText Documentum Content Server 7.3
See all- CVE-2017-15276High
OpenText Documentum Content Server up to version 7.3 contains a design gap that allows an authenticated user to gain superuser privileges. The issue arises from the failure to verify the contents of TAR archives during unpacking, leading to a path traversal vulnerability via symlinks.
- CVE-2017-15013High
OpenText Documentum Content Server up to version 7.3 contains a design gap that allows an authenticated user to gain superuser privileges. Users can edit dmr_content objects, enabling them to replace the content of security-sensitive dmr_content objects.
- CVE-2017-15012High
OpenText Documentum Content Server versions up to 7.3 improperly validate the input of the PUT_FILE RPC command, allowing any authenticated user to hijack an arbitrary file from the Content Server filesystem. Since some files are security-sensitive, this leads to privilege escalation.
- CVE-2017-7221High
OpenText Documentum Content Server has an inadequate protection mechanism against SQL injection, allowing remote authenticated users to execute arbitrary code with super-user privileges. This is exploited through the dm_bp_transition method and a user-created dm_procedure object.
- CVE-2017-7220High
OpenText Documentum Content Server allows superuser access via sys_obj_save or save of a crafted object, followed by an unauthorized 'UPDATE dm_dbo.dm_user_s SET user_privileges=16' command, known as an 'RPC save-commands' attack.
Original NVD description (English source)
OpenText Documentum Content Server (formerly EMC Documentum Content Server) 7.3, when PostgreSQL Database is used and return_top_results_row_based config option is false, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and execute arbitrary DML or DDL commands via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2520.