CVE-2014-4626
EMC Documentum Content Server ESA-2014-105 Fail
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
EMC Documentum Content Server before 6.7 SP1 P29, 6.7 SP2 before P18, 7.0 before P16, and 7.1 before P09 allows remote authenticated users to gain privileges by (1) placing a command in a dm_job object and setting this object's owner to a privileged user or placing a rename action in a dm_job_request object and waiting for a (2) dm_UserRename or (3) dm_GroupRename service task, aka ESA-2014-105. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2515.
EMC Documentum Content Server anterior a 6.7 SP1 P29, 6.7 SP2 anterior a P18, 7.0 anterior a P16, y 7.1 anterior a P09 permite a usuarios remotos autenticados ganar privilegios mediante (1) lla colocación de un comando en un objeto dm_job y la configutación del dueño de este objeto a un usuario privilegiado o la colocación de una acción de renombrar en un objeto dm_job_request y la espera a una tarea de servicio (2) dm_UserRename o (3) dm_GroupRename, también conocido como ESA-2014-105. NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2014-2515.
A vulnerability exists in the EMC Documentum Content Server which allows an authenticated user to elevate privileges, hijack Content Server filesystem, or execute arbitrary commands by creating malicious dm_job objects. Although ESA-2014-105 claimed to remediate this issue, it persists.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2014-06-24 CVE Reserved
- 2014-12-17 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| http://www.kb.cert.org/vuls/id/315340 | Third Party Advisory |
|
| http://www.kb.cert.org/vuls/id/386056 | Third Party Advisory |
|
| http://www.kb.cert.org/vuls/id/874632 | Third Party Advisory |
|
| https://docs.google.com/spreadsheets/d/1DiiUPCPvmaliWcfwPSc36y2mDvuidkDKQBWqaIuJi0A/edit?usp=sharing | X_refsource_misc |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Emc Search vendor "Emc" | Documentum Content Server Search vendor "Emc" for product "Documentum Content Server" | <= 6.7 Search vendor "Emc" for product "Documentum Content Server" and version " <= 6.7" | sp1 |
Affected
| ||||||
| Emc Search vendor "Emc" | Documentum Content Server Search vendor "Emc" for product "Documentum Content Server" | 6.7 Search vendor "Emc" for product "Documentum Content Server" and version "6.7" | - |
Affected
| ||||||
| Emc Search vendor "Emc" | Documentum Content Server Search vendor "Emc" for product "Documentum Content Server" | 6.7 Search vendor "Emc" for product "Documentum Content Server" and version "6.7" | sp2 |
Affected
| ||||||
| Emc Search vendor "Emc" | Documentum Content Server Search vendor "Emc" for product "Documentum Content Server" | 7.0 Search vendor "Emc" for product "Documentum Content Server" and version "7.0" | - |
Affected
| ||||||
| Emc Search vendor "Emc" | Documentum Content Server Search vendor "Emc" for product "Documentum Content Server" | 7.1 Search vendor "Emc" for product "Documentum Content Server" and version "7.1" | - |
Affected
| ||||||