CVE-2014-2520
First published: Wed Aug 20 2014(Updated: )
EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07, when Oracle Database is used, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and read sensitive database content via a crafted request.
Credit: security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| EMC Documentum Content Server | <=6.7 | |
| EMC Documentum Content Server | =6.0 | |
| EMC Documentum Content Server | =6.5 | |
| EMC Documentum Content Server | =6.5-sp1 | |
| EMC Documentum Content Server | =6.5-sp2 | |
| EMC Documentum Content Server | =6.5-sp3 | |
| EMC Documentum Content Server | =6.6 | |
| EMC Documentum Content Server | =6.7 | |
| EMC Documentum Content Server | =6.7-sp1 | |
| EMC Documentum Content Server | =7.0 | |
| EMC Documentum Content Server | =7.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-2520?
CVE-2014-2520 has a medium severity level due to the potential for DQL injection attacks.
How do I fix CVE-2014-2520?
To mitigate CVE-2014-2520, upgrade to EMC Documentum Content Server version 6.7 SP2 P16 or later or 7.1 P07 or later.
What type of attack does CVE-2014-2520 allow?
CVE-2014-2520 allows remote authenticated users to conduct DQL injection attacks that may expose sensitive database content.
Which software versions are affected by CVE-2014-2520?
CVE-2014-2520 affects EMC Documentum Content Server versions 6.0, 6.5, 6.6, 6.7 prior to SP2 P16, and 7.x prior to P07.
Who is at risk from CVE-2014-2520?
Remote authenticated users with access to the affected EMC Documentum Content Server could exploit CVE-2014-2520.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/author
- agent/references
- agent/description
- agent/tags
- agent/first-publish-date
- agent/event
- agent/source
- vendor/emc
- canonical/emc documentum content server
- version/emc documentum content server/6.7
- version/emc documentum content server/6.0
- version/emc documentum content server/6.5
- version/emc documentum content server/6.5-sp1
- version/emc documentum content server/6.5-sp2
- version/emc documentum content server/6.5-sp3
- version/emc documentum content server/6.6
- version/emc documentum content server/6.7-sp1
- version/emc documentum content server/7.0
- version/emc documentum content server/7.1