PT-2017-13818 · Opentext · Opentext Documentum Content Server

Andrey B. Panfilov · Publicado 2017-10-13 · Atualizado 2019-10-03 · CVE-2017-15013

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenText Documentum Content Server versions through 7.3

Description The issue allows an authenticated user to gain superuser privileges by exploiting a design gap in how Content Server stores and manages information about uploaded files in dmr content objects. These objects are queryable and can be modified by authenticated users, who can delete a dmr content object and then create a new one with the same identifier. This capability enables any authenticated user to replace the content of security-sensitive dmr content objects, such as those related to dm method objects, thereby gaining superuser privileges.

Recommendations For OpenText Documentum Content Server versions through 7.3, consider restricting access to dmr content objects to prevent authenticated users from modifying security-sensitive content, and limit the ability to delete and recreate dmr content objects with the same identifier. As a temporary workaround, consider implementing strict access controls on dmr content objects related to dm method objects to minimize the risk of exploitation.

Exploit

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2017-15013

Produtos afetados

Opentext Documentum Content Server

Referências · 5

• 🔥 https://exploit-db.com/exploits/43004 · Exploit
• https://osv.dev/vulnerability/CVE-2017-15013 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15013 · Nota de Segurança
• http://securityfocus.com/bid/101639 · Nota
• http://seclists.org/bugtraq/2017/Oct/19 · Nota