PT-2014-5112 · Xerox · Xerox Docushare

Brandon Perry

·

Publicado

2014-05-02

·

Atualizado

2017-08-29

·

CVE-2014-3138

CVSS v2.0

6.5

Média

VetorAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Xerox DocuShare versions prior to 6.53 Patch 6 Hotfix 2 Xerox DocuShare versions 6.6.1 Update 1 prior to Hotfix 24 Xerox DocuShare versions 6.6.1 Update 2 prior to Hotfix 3
Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the PATH INFO to "/docushare/dsweb/ResultBackgroundJobMultiple/".
Recommendations For versions prior to 6.53 Patch 6 Hotfix 2, update to 6.53 Patch 6 Hotfix 2 or later. For versions 6.6.1 Update 1 prior to Hotfix 24, apply Hotfix 24 or later. For versions 6.6.1 Update 2 prior to Hotfix 3, apply Hotfix 3 or later.

Exploit

Correção

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2014-3138

Produtos afetados

Xerox Docushare