PT-2014-4741 · Emc · Emc Documentum Digital Assets Manager

Published 2014-06-06 · Updated 2014-06-18 · CVE-2014-2503

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions EMC Documentum Digital Asset Manager (DAM) versions 6.5 SP3 through 6.5 SP6 before P13

Description The issue allows remote attackers to conduct Documentum Query Language (DQL) injection attacks, bypassing intended restrictions on querying objects. This is achieved via a crafted parameter in a query string.

Recommendations For versions 6.5 SP3 through 6.5 SP6 before P13, apply the patch P13 to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-2503

Affected Products

Emc Documentum Digital Assets Manager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-2503 · Security Note
• http://packetstormsecurity.com/files/126947/EMC-Documentum-Digital-Asset-Manager-Blind-DQL-Injection.html · Note
• http://archives.neohapsis.com/archives/bugtraq/2014-06/0037.html · Note
• http://securitytracker.com/id/1030348 · Note
• http://securityfocus.com/bid/67868 · Note