PT-2014-4752 · Emc · Emc Documentum Content Server

Published 2014-07-08 · Updated 2017-01-07 · CVE-2014-2514

Positive Technologies (AI Summary)

CVSS v2.0

8.2

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions EMC Documentum Content Server versions prior to 6.7 SP1 P28 EMC Documentum Content Server versions 6.7 SP2 prior to P15 EMC Documentum Content Server versions 7.0 prior to P15 EMC Documentum Content Server versions 7.1 prior to P06

Description The issue allows remote authenticated users to execute arbitrary code with super-user privileges due to improper authorization checks and insufficient restrictions on object types. This can be achieved by running save RPC commands via unspecified vectors.

Recommendations For versions prior to 6.7 SP1 P28, update to 6.7 SP1 P28 or later. For versions 6.7 SP2 prior to P15, update to 6.7 SP2 P15 or later. For versions 7.0 prior to P15, update to 7.0 P15 or later. For versions 7.1 prior to P06, update to 7.1 P06 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-2514

Affected Products

Emc Documentum Content Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-2514 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2014-07/0024.html · Note
• http://securitytracker.com/id/1030529 · Note
• http://secunia.com/advisories/59757 · Note
• http://securityfocus.com/bid/68436 · Note