CVE-2017-7220
HighSummary
OpenText Documentum Content Server allows superuser access via sys_obj_save or save of a crafted object, followed by an unauthorized 'UPDATE dm_dbo.dm_user_s SET user_privileges=16' command, known as an 'RPC save-commands' attack.
Risk Assessment
This vulnerability may lead to unauthorized access to the system, posing a serious threat to the organization's data security.
Recommendation
It is recommended to update the system to the latest version to patch this vulnerability and conduct an audit of user privileges.
Other vulnerabilities in OpenText Documentum Content Server
See all- CVE-2017-15276High
OpenText Documentum Content Server up to version 7.3 contains a design gap that allows an authenticated user to gain superuser privileges. The issue arises from the failure to verify the contents of TAR archives during unpacking, leading to a path traversal vulnerability via symlinks.
- CVE-2017-15013High
OpenText Documentum Content Server up to version 7.3 contains a design gap that allows an authenticated user to gain superuser privileges. Users can edit dmr_content objects, enabling them to replace the content of security-sensitive dmr_content objects.
- CVE-2017-15012High
OpenText Documentum Content Server versions up to 7.3 improperly validate the input of the PUT_FILE RPC command, allowing any authenticated user to hijack an arbitrary file from the Content Server filesystem. Since some files are security-sensitive, this leads to privilege escalation.
- CVE-2017-7221High
OpenText Documentum Content Server has an inadequate protection mechanism against SQL injection, allowing remote authenticated users to execute arbitrary code with super-user privileges. This is exploited through the dm_bp_transition method and a user-created dm_procedure object.
- CVE-2017-5585High
Vulnerability in OpenText Documentum Content Server 7.3, when using PostgreSQL Database and the return_top_results_row_based config option is set to false, allows improper restriction of DQL hints. This enables remote authenticated users to conduct DQL injection attacks and execute arbitrary DML or DDL commands via a crafted request.
Original NVD description (English source)
OpenText Documentum Content Server allows superuser access via sys_obj_save or save of a crafted object, followed by an unauthorized "UPDATE dm_dbo.dm_user_s SET user_privileges=16" command, aka an "RPC save-commands" attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4532.