CVE-2013-6173: CSRF
Multiple cross-site request forgery (CSRF) vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote attackers to hijack the authentication of administrators for requests that perform administrative actions in (1) xAdmin or (2) xDashboard.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EMC Document Sciences xPressionto a version that resolves this vulnerability.Fixed in 4.1 SP1Patch Patch 47 - Upgrade
Upgrade
EMC Document Sciences xPressionto a version that resolves this vulnerability.Fixed in 4.2Patch Patch 26 - Upgrade
Upgrade
EMC Document Sciences xPressionto a version that resolves this vulnerability.Fixed in 4.5Patch Patch 05
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6173?
CVE-2013-6173 is classified as having a medium severity level due to its potential for remote exploitation through CSRF attacks.
How do I fix CVE-2013-6173?
To fix CVE-2013-6173, users should apply the necessary patches: Patch 47 for version 4.1 SP1, Patch 26 for version 4.2, and Patch 05 for version 4.5.
Which versions of EMC Document Sciences xPression are affected by CVE-2013-6173?
CVE-2013-6173 affects EMC Document Sciences xPression versions 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05.
What types of attacks are enabled by CVE-2013-6173?
CVE-2013-6173 allows remote attackers to conduct cross-site request forgery (CSRF) attacks, potentially hijacking user sessions.
Is CVE-2013-6173 specific to certain EMC products?
Yes, CVE-2013-6173 specifically impacts EMC Documentum Edition as well as the Enterprise Edition Publish Engine and Compuset Engine.