PT-2014-4742 · Emc · Emc Documentum D2

Publicado 2014-05-23 · Atualizado 2014-06-18 · CVE-2014-2504

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EMC Documentum D2 versions 3.1 before P20 EMC Documentum D2 version 3.1 SP1 before P02 EMC Documentum D2 version 4.0 before P10 EMC Documentum D2 version 4.1 before P13 EMC Documentum D2 version 4.2 before P01

Description The issue allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language (DQL) queries. This can be achieved by calling either a core method or a D2FS web-service method.

Recommendations For version 3.1, update to P20 or later. For version 3.1 SP1, update to P02 or later. For version 4.0, update to P10 or later. For version 4.1, update to P13 or later. For version 4.2, update to P01 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-2504

Produtos afetados

Emc Documentum D2

Referências · 4

• http://securitytracker.com/id/1030282 · Nota
• http://secunia.com/advisories/58938 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2504 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/current/0130.html · Nota