CVE-2017-15276: Path Traversal
OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows an authenticated user to gain superuser privileges: Content Server allows uploading content using batches (TAR archives). When unpacking TAR archives, Content Server fails to verify the contents of an archive, which causes a path traversal vulnerability via symlinks. Because some files on the Content Server filesystem are security-sensitive, this leads to privilege escalation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15276?
CVE-2017-15276 is classified as a critical vulnerability due to its potential for privilege escalation.
How do I fix CVE-2017-15276?
To fix CVE-2017-15276, users should upgrade OpenText Documentum Content Server to a version above 7.3.
What type of attack does CVE-2017-15276 enable?
CVE-2017-15276 allows an authenticated user to gain superuser privileges through the exploitation of design flaws in TAR archive handling.
Who is affected by CVE-2017-15276?
CVE-2017-15276 affects all versions of OpenText Documentum Content Server up to and including 7.3.
Can CVE-2017-15276 be exploited remotely?
Exploitation of CVE-2017-15276 requires authenticated access, so it cannot be directly exploited remotely.