// For flags

CVE-2017-14527

OpenText Documentum Administrator / Webtop XXE Injection

Severity Score

8.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Webtop 6.8.0160.0073 allow remote authenticated users to list the contents of arbitrary directories, read arbitrary files, cause a denial of service, or, on Windows, obtain Documentum user hashes via a (1) crafted DTD, involving unspecified XML structures in a request to xda/com/documentum/ucf/server/transport/impl/GAIRConnector or crafted XML file in a MediaProfile file (2) import or (3) check in.

Múltiples vulnerabilidades de XEE (XML External Entity) en la versión 6.8.0160.0073 de OpenText Documentum Webtop permiten que los usuarios autenticados remotos listen el contenido de directorios remotos, lean archivos arbitrarios, provoquen una denegación de servicio o, en Windows, obtengan hashes de usuario Documentum mediante (1) un archivo DTD manipulado, que implica estructuras XML sin especificar en una petición a xda/com/documentum/ucf/server/transport/impl/GAIRConnector o un archivo XML manipulado en un archivo MediaProfile (2) importado o (3) insertado en el repositorio.

OpenText Documentum Administrator version 7.2.0180.0055 and Documentum Webtop version 6.8.0160.0073 suffer from XML external entity injection vulnerabilities.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2017-09-17 CVE Reserved
  • 2017-09-27 CVE Published
  • 2023-11-23 EPSS Updated
  • 2024-08-05 CVE Updated
  • 2024-08-05 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-611: Improper Restriction of XML External Entity Reference
CAPEC
References (1)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Opentext
Search vendor "Opentext"
Documentum Administrator
Search vendor "Opentext" for product "Documentum Administrator"
7.2.0180.0055
Search vendor "Opentext" for product "Documentum Administrator" and version "7.2.0180.0055"
-
Affected
Opentext
Search vendor "Opentext"
Documentum Webtop
Search vendor "Opentext" for product "Documentum Webtop"
6.8.0160.0073
Search vendor "Opentext" for product "Documentum Webtop" and version "6.8.0160.0073"
-
Affected