PT-2017-3003 · Opentext · Opentext Document Sciences Xpression

Marcin Wołoszyn · Publicado 2017-09-27 · Atualizado 2017-10-11 · CVE-2017-14759

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenText Document Sciences xPression versions prior to v4.5SP1 Patch 13

Description The issue is caused by an XML External Entity vulnerability. An unauthenticated user can exploit this to read directory listings or system files, or cause Server-Side Request Forgery (SSRF) or Denial of Service. The vulnerability is associated with the /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/ endpoint.

Recommendations For versions prior to v4.5SP1 Patch 13, update to v4.5SP1 Patch 13 or later to resolve the issue. As a temporary workaround, consider restricting access to the /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/ endpoint until a patch is applied.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2017-02355

CVE-2017-14759

Produtos afetados

Opentext Document Sciences Xpression

Referências · 5

• https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-14759 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-02355 · Nota de Segurança
• http://seclists.org/fulldisclosure/2017/Sep/97 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-14759 · Nota de Segurança