PT-2017-13671 · Opentext · Opentext Document Sciences Xpression

Publicado 2017-10-02 · Atualizado 2017-10-11 · CVE-2017-14756

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenText Document Sciences xPression versions prior to v4.5SP1 Patch 13

Description The issue is related to Cross-Site Scripting. The /xAdmin/html/Deployment API endpoint is affected, specifically the cat id variable.

Recommendations For versions prior to v4.5SP1 Patch 13, update to v4.5SP1 Patch 13 or a newer version to resolve the issue. As a temporary workaround, consider restricting access to the /xAdmin/html/Deployment API endpoint to minimize the risk of exploitation. Avoid using the cat id variable in the affected endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-14756

Produtos afetados

Opentext Document Sciences Xpression

Referências · 4

• 🔥 http://seclists.org/fulldisclosure/2017/Sep/96 · Exploit
• https://osv.dev/vulnerability/CVE-2017-14756 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14756 · Nota de Segurança
• https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774 · Aviso do Fabricante