PT-2014-4742 · Emc · Emc Documentum D2

Published 2014-05-23 · Updated 2014-06-18 · CVE-2014-2504

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EMC Documentum D2 versions 3.1 before P20 EMC Documentum D2 version 3.1 SP1 before P02 EMC Documentum D2 version 4.0 before P10 EMC Documentum D2 version 4.1 before P13 EMC Documentum D2 version 4.2 before P01

Description The issue allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language (DQL) queries. This can be achieved by calling either a core method or a D2FS web-service method.

Recommendations For version 3.1, update to P20 or later. For version 3.1 SP1, update to P02 or later. For version 4.0, update to P10 or later. For version 4.1, update to P13 or later. For version 4.2, update to P01 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-2504

Affected Products

Emc Documentum D2

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-2504 · Security Note
• http://securitytracker.com/id/1030282 · Note
• http://secunia.com/advisories/58938 · Note
• http://archives.neohapsis.com/archives/bugtraq/current/0130.html · Note