CVE-2017-15013: High severity OpenText Documentum Content Server vulnerability
OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows an authenticated user to gain superuser privileges: Content Server stores information about uploaded files in dmrcontent objects, which are queryable and "editable" (before release 7.2P02, any authenticated user was able to edit dmrcontent objects; now any authenticated user may delete a dmrcontent object and then create a new one with the old identifier) by authenticated users; this allows any authenticated user to replace the content of security-sensitive dmrcontent objects (for example, dmrcontent related to dmmethod objects) and gain superuser privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15013?
CVE-2017-15013 is considered a critical vulnerability due to its potential to allow authenticated users to gain superuser privileges.
How do I fix CVE-2017-15013?
To fix CVE-2017-15013, it is recommended to upgrade OpenText Documentum Content Server to a version later than 7.3 that addresses this vulnerability.
Who can be affected by CVE-2017-15013?
Authenticated users of OpenText Documentum Content Server versions up to 7.3 can be affected by CVE-2017-15013.
What type of vulnerability is CVE-2017-15013?
CVE-2017-15013 is classified as a design gap that leverages improper access control mechanisms.
What are the consequences of CVE-2017-15013?
The consequences of CVE-2017-15013 include unauthorized escalation of privileges, allowing users to perform actions beyond their intended permissions.