OpenText Document Sciences xPression v4.5SP1 Patch 13 vulnerabilities
3 known CVE vulnerabilities in OpenText Document Sciences xPression v4.5SP1 Patch 13, translated and rated.
- CVE-2017-14758High
OpenText Document Sciences xPression version 4.5SP1 Patch 13 (older versions may also be affected) is prone to SQL Injection in the documentId parameter on the /xAdmin/html/cm_doclist_view_uc.jsp page. To exploit this vulnerability, an attacker must first authenticate to the application.
- CVE-2017-14757High
OpenText Document Sciences xPression version 4.5SP1 Patch 13 (older versions may also be affected) is prone to SQL Injection in the jobRunId parameter at /xDashboard/html/jobhistory/downloadSupportFile.action. An attacker must authenticate to the application first to exploit this vulnerability.
- CVE-2017-14759Critical
OpenText Document Sciences xPression version 4.5SP1 Patch 13 (older versions might also be affected) has an XML External Entity vulnerability. An unauthenticated user can read directory listings or system files, or cause SSRF or Denial of Service.