PT-2017-3003 · Opentext · Opentext Document Sciences Xpression

Marcin Wołoszyn · Published 2017-09-27 · Updated 2017-10-11 · CVE-2017-14759

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenText Document Sciences xPression versions prior to v4.5SP1 Patch 13

Description The issue is caused by an XML External Entity vulnerability. An unauthenticated user can exploit this to read directory listings or system files, or cause Server-Side Request Forgery (SSRF) or Denial of Service. The vulnerability is associated with the /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/ endpoint.

Recommendations For versions prior to v4.5SP1 Patch 13, update to v4.5SP1 Patch 13 or later to resolve the issue. As a temporary workaround, consider restricting access to the /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/ endpoint until a patch is applied.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2017-02355

CVE-2017-14759

Affected Products

Opentext Document Sciences Xpression

References · 5

• https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-14759 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02355 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-14759 · Security Note
• http://seclists.org/fulldisclosure/2017/Sep/97 · Note