PT-2013-4277 · Emc · Emc Documentum Administrator+7

Tudor Enache · Published 2013-11-06 · Updated 2013-12-20 · CVE-2013-3281

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions EMC Documentum Webtop versions prior to 6.7 SP2 P07 EMC Documentum WDK versions prior to 6.7 SP2 P07 EMC Documentum Taskspace versions prior to 6.7 SP2 P07 EMC Documentum Records Manager versions prior to 6.7 SP2 P07 EMC Documentum Web Publisher versions prior to 6.5 SP7 EMC Documentum Digital Asset Manager versions prior to 6.5 SP6 EMC Documentum Administrator versions prior to 6.7 SP2 P07 EMC Documentum Capital Projects versions prior to 1.8 P01

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a crafted parameter in a URL. This can be exploited by sending a malicious URL with a crafted parameter to inject web script or HTML.

Recommendations For EMC Documentum Webtop versions prior to 6.7 SP2 P07, update to version 6.7 SP2 P07 or later. For EMC Documentum WDK versions prior to 6.7 SP2 P07, update to version 6.7 SP2 P07 or later. For EMC Documentum Taskspace versions prior to 6.7 SP2 P07, update to version 6.7 SP2 P07 or later. For EMC Documentum Records Manager versions prior to 6.7 SP2 P07, update to version 6.7 SP2 P07 or later. For EMC Documentum Web Publisher versions prior to 6.5 SP7, update to version 6.5 SP7 or later. For EMC Documentum Digital Asset Manager versions prior to 6.5 SP6, update to version 6.5 SP6 or later. For EMC Documentum Administrator versions prior to 6.7 SP2 P07, update to version 6.7 SP2 P07 or later. For EMC Documentum Capital Projects versions prior to 1.8 P01, update to version 1.8 P01 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-3281

Affected Products

Emc Documentum Administrator

Documentum Capital Projects

Emc Documentum Digital Assets Manager

Emc Documentum Records Manager

Emc Documentum Taskspace

Documentum Wdk

Emc Documentum Web Publisher

Documentum Webtop

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-3281 · Security Note
• http://kb.cert.org/vuls/id/466876 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3281 · Note
• http://archives.neohapsis.com/archives/bugtraq/2013-11/0018.html · Note