PT-2014-4741 · Emc · Emc Documentum Digital Assets Manager

Publicado 2014-06-06 · Atualizado 2014-06-18 · CVE-2014-2503

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions EMC Documentum Digital Asset Manager (DAM) versions 6.5 SP3 through 6.5 SP6 before P13

Description The issue allows remote attackers to conduct Documentum Query Language (DQL) injection attacks, bypassing intended restrictions on querying objects. This is achieved via a crafted parameter in a query string.

Recommendations For versions 6.5 SP3 through 6.5 SP6 before P13, apply the patch P13 to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-2503

Produtos afetados

Emc Documentum Digital Assets Manager

Referências · 5

• http://packetstormsecurity.com/files/126947/EMC-Documentum-Digital-Asset-Manager-Blind-DQL-Injection.html · Nota
• http://archives.neohapsis.com/archives/bugtraq/2014-06/0037.html · Nota
• http://securitytracker.com/id/1030348 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2503 · Nota de Segurança
• http://securityfocus.com/bid/67868 · Nota