Go to homepageCyberStrike

Menu

Star on GitHub · 3.2k
Sign inDownload

CVE-2017-15014

4.3 · MEDIUM

OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows authenticated users to download arbitrary content files regar…

Published Oct 13, 2017CWE-269EPSS 4.95%

Overview

CVE-2017-15014 is a medium-severity vulnerability. It was published on October 13, 2017 and has a CVSS 3.0 base score of 4.3 (MEDIUM).

This vulnerability has a CVSS 3.0 base score of 4.3, rated MEDIUM. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

Technical description

OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows authenticated users to download arbitrary content files regardless of the attacker's repository permissions: When an authenticated user uploads content to the repository, he performs the following steps: (1) calls the START_PUSH RPC-command; (2) uploads the file to the content server; (3) calls the END_PUSH_V2 RPC-command (here, Content Server returns a DATA_TICKET integer, intended to identify the location of the uploaded file on the Content Server filesystem); (4) creates a dmr_content object in the repository, which has a value of data_ticket equal to the value of DATA_TICKET returned at the end of END_PUSH_V2 call. As the result of this design, any authenticated user may create his own dmr_content object, pointing to already existing content in the Content Server filesystem.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refseclists.org/bugtraq/2017/Oct/19Refwww.securityfocus.com/bid/101639Refwww.exploit-db.com/exploits/43005/Refseclists.org/bugtraq/2017/Oct/19Refwww.securityfocus.com/bid/101639Refwww.exploit-db.com/exploits/43005/

How CyberStrike helps

Frequently asked questions

What is CVE-2017-15014?

CVE-2017-15014 is a medium-severity vulnerability. It was published on October 13, 2017 and has a CVSS 3.0 base score of 4.3 (MEDIUM).

How severe is CVE-2017-15014?

This vulnerability has a CVSS 3.0 base score of 4.3, rated MEDIUM. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2017-15014?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2017-15014?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2017-15014 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related MEDIUM CVEs from 2017

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999