CVE-2017-7221
HighSummary
OpenText Documentum Content Server has an inadequate protection mechanism against SQL injection, allowing remote authenticated users to execute arbitrary code with super-user privileges. This is exploited through the dm_bp_transition method and a user-created dm_procedure object.
Risk Assessment
This vulnerability can lead to serious security breaches, allowing attackers to gain full control over the system. It may result in data loss and compromise of sensitive information.
Recommendation
It is recommended to update the OpenText Documentum Content Server to the latest version that includes security patches. An audit of existing procedures and user permissions should also be conducted.
Other vulnerabilities in OpenText Documentum Content Server
See all- CVE-2017-15276High
OpenText Documentum Content Server up to version 7.3 contains a design gap that allows an authenticated user to gain superuser privileges. The issue arises from the failure to verify the contents of TAR archives during unpacking, leading to a path traversal vulnerability via symlinks.
- CVE-2017-15013High
OpenText Documentum Content Server up to version 7.3 contains a design gap that allows an authenticated user to gain superuser privileges. Users can edit dmr_content objects, enabling them to replace the content of security-sensitive dmr_content objects.
- CVE-2017-15012High
OpenText Documentum Content Server versions up to 7.3 improperly validate the input of the PUT_FILE RPC command, allowing any authenticated user to hijack an arbitrary file from the Content Server filesystem. Since some files are security-sensitive, this leads to privilege escalation.
- CVE-2017-7220High
OpenText Documentum Content Server allows superuser access via sys_obj_save or save of a crafted object, followed by an unauthorized 'UPDATE dm_dbo.dm_user_s SET user_privileges=16' command, known as an 'RPC save-commands' attack.
- CVE-2017-5585High
Vulnerability in OpenText Documentum Content Server 7.3, when using PostgreSQL Database and the return_top_results_row_based config option is set to false, allows improper restriction of DQL hints. This enables remote authenticated users to conduct DQL injection attacks and execute arbitrary DML or DDL commands via a crafted request.
Original NVD description (English source)
OpenText Documentum Content Server has an inadequate protection mechanism against SQL injection, which allows remote authenticated users to execute arbitrary code with super-user privileges by leveraging the availability of the dm_bp_transition docbase method with a user-created dm_procedure object, as demonstrated by use of a backspace character in an injected string. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2513.