CVE-2017-15014: Medium severity OpenText Documentum Content Server vulnerability
OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows authenticated users to download arbitrary content files regardless of the attacker's repository permissions: When an authenticated user uploads content to the repository, he performs the following steps: (1) calls the STARTPUSH RPC-command; (2) uploads the file to the content server; (3) calls the ENDPUSHV2 RPC-command (here, Content Server returns a DATATICKET integer, intended to identify the location of the uploaded file on the Content Server filesystem); (4) creates a dmrcontent object in the repository, which has a value of dataticket equal to the value of DATATICKET returned at the end of ENDPUSHV2 call. As the result of this design, any authenticated user may create his own dmrcontent object, pointing to already existing content in the Content Server filesystem.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15014?
CVE-2017-15014 has a medium severity rating due to the potential for authenticated users to access unauthorized content.
How do I fix CVE-2017-15014?
To fix CVE-2017-15014, update your OpenText Documentum Content Server to version 7.4 or later, which addresses this design gap.
Who is affected by CVE-2017-15014?
CVE-2017-15014 affects users of OpenText Documentum Content Server versions up to and including 7.3.
What is the impact of exploiting CVE-2017-15014?
Exploiting CVE-2017-15014 allows authenticated users to download arbitrary content files regardless of their repository permissions.
Can CVE-2017-15014 be exploited remotely?
CVE-2017-15014 requires authentication, so it cannot be exploited remotely without valid user credentials.