CVE-2014-2520: Medium severity opentext documentum content server vulnerability
EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07, when Oracle Database is used, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and read sensitive database content via a crafted request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2520?
CVE-2014-2520 has a medium severity level due to the potential for DQL injection attacks.
How do I fix CVE-2014-2520?
To mitigate CVE-2014-2520, upgrade to EMC Documentum Content Server version 6.7 SP2 P16 or later or 7.1 P07 or later.
What type of attack does CVE-2014-2520 allow?
CVE-2014-2520 allows remote authenticated users to conduct DQL injection attacks that may expose sensitive database content.
Which software versions are affected by CVE-2014-2520?
CVE-2014-2520 affects EMC Documentum Content Server versions 6.0, 6.5, 6.6, 6.7 prior to SP2 P16, and 7.x prior to P07.
Who is at risk from CVE-2014-2520?
Remote authenticated users with access to the affected EMC Documentum Content Server could exploit CVE-2014-2520.