CVE-2017-15012: Input Validation
OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 does not properly validate the input of the PUTFILE RPC-command, which allows any authenticated user to hijack an arbitrary file from the Content Server filesystem; because some files on the Content Server filesystem are security-sensitive, this leads to privilege escalation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15012?
CVE-2017-15012 is rated as a high-severity vulnerability due to its potential for unauthorized file access.
How do I fix CVE-2017-15012?
To fix CVE-2017-15012, ensure that you update OpenText Documentum Content Server to a version newer than 7.3 that addresses this vulnerability.
What types of attacks can occur due to CVE-2017-15012?
CVE-2017-15012 can be exploited to hijack arbitrary files from the Content Server filesystem, which may lead to unauthorized data access.
Who is affected by CVE-2017-15012?
CVE-2017-15012 affects all users of OpenText Documentum Content Server versions up to and including 7.3.
What is the main cause of CVE-2017-15012?
The main cause of CVE-2017-15012 is the lack of proper input validation in the PUT_FILE RPC-command.