OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows authenticated users to download arbitrary content files regardless of the attacker's repository permissions: When an authenticated user uploads content to the repository, he performs the following steps: (1) calls the START_PUSH RPC-command; (2) uploads the file to the content server; (3) calls the END_PUSH_V2 RPC-command (here, Content Server returns a DATA_TICKET integer, intended to identify the location of the uploaded file on the Content Server filesystem); (4) creates a dmr_content object in the repository, which has a value of data_ticket equal to the value of DATA_TICKET returned at the end of END_PUSH_V2 call. As the result of this design, any authenticated user may create his own dmr_content object, pointing to already existing content in the Content Server filesystem.
References
| Link | Resource |
|---|---|
| http://seclists.org/bugtraq/2017/Oct/19 | Mailing List Third Party Advisory VDB Entry |
| http://www.securityfocus.com/bid/101639 | |
| https://www.exploit-db.com/exploits/43005/ | |
| http://seclists.org/bugtraq/2017/Oct/19 | Mailing List Third Party Advisory VDB Entry |
| http://www.securityfocus.com/bid/101639 | |
| https://www.exploit-db.com/exploits/43005/ |
Configurations
History
21 Nov 2024, 03:13
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://seclists.org/bugtraq/2017/Oct/19 - Mailing List, Third Party Advisory, VDB Entry | |
| References | () http://www.securityfocus.com/bid/101639 - | |
| References | () https://www.exploit-db.com/exploits/43005/ - |
Information
Published : 2017-10-13 16:29
Updated : 2024-11-21 03:13
NVD link : CVE-2017-15014
Mitre link : CVE-2017-15014
CVE.ORG link : CVE-2017-15014
JSON object : View
Products Affected
opentext
- documentum_content_server
CWE
CWE-269
Improper Privilege Management