FKIE_CVE-2017-15013

Vulnerability from fkie_nvd - Published: 2017-10-13 16:29 - Updated: 2025-04-20 01:37
Severity ?
8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows an authenticated user to gain superuser privileges: Content Server stores information about uploaded files in dmr_content objects, which are queryable and "editable" (before release 7.2P02, any authenticated user was able to edit dmr_content objects; now any authenticated user may delete a dmr_content object and then create a new one with the old identifier) by authenticated users; this allows any authenticated user to replace the content of security-sensitive dmr_content objects (for example, dmr_content related to dm_method objects) and gain superuser privileges.
References
cve@mitre.orghttp://seclists.org/bugtraq/2017/Oct/19Mailing List, Third Party Advisory, VDB Entry
cve@mitre.orghttp://www.securityfocus.com/bid/101639
cve@mitre.orghttps://www.exploit-db.com/exploits/43004/
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/bugtraq/2017/Oct/19Mailing List, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/101639
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/43004/
Impacted products
Vendor Product Version
opentext documentum_content_server *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opentext:documentum_content_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "78887F85-A395-41C2-AED8-2857620518A7",
              "versionEndIncluding": "7.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows an authenticated user to gain superuser privileges: Content Server stores information about uploaded files in dmr_content objects, which are queryable and \"editable\" (before release 7.2P02, any authenticated user was able to edit dmr_content objects; now any authenticated user may delete a dmr_content object and then create a new one with the old identifier) by authenticated users; this allows any authenticated user to replace the content of security-sensitive dmr_content objects (for example, dmr_content related to dm_method objects) and gain superuser privileges."
    },
    {
      "lang": "es",
      "value": "OpenText Documentum Content Server (anteriormente conocido como EMC Documentum Content Server) hasta la versi\u00f3n 7.3 contiene el siguiente fallo de dise\u00f1o, que permite que un usuario autenticado gane privilegios de superuser: Content Server almacena informaci\u00f3n sobre archivos subidos en objetos dmr_content, los cuales son consultables y \"editables\" (antes de la distribuci\u00f3n 7.2P02, cualquier usuario autenticado pod\u00eda editar objetos dmr_content; ahora cualquier usuario autenticado puede borrar objetos dmr_content y, a continuaci\u00f3n, crear uno nuevo con el antiguo identificador) por usuarios autenticados. Esto permite que cualquier usuario autenticado reemplace el contenido de objetos dmr_content sensibles (por ejemplo, contenido dmr_content relacionado con objetos dm_method objects) y obteniendo privilegios de superuser."
    }
  ],
  "id": "CVE-2017-15013",
  "lastModified": "2025-04-20T01:37:25.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": true,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-10-13T16:29:00.247",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://seclists.org/bugtraq/2017/Oct/19"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/101639"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/43004/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://seclists.org/bugtraq/2017/Oct/19"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/101639"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/43004/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.