CVE-2017-5585: High severity OpenText Documentum Content Server vulnerability
OpenText Documentum Content Server (formerly EMC Documentum Content Server) 7.3, when PostgreSQL Database is used and returntopresultsrowbased config option is false, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and execute arbitrary DML or DDL commands via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2520.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5585?
CVE-2017-5585 has been assigned a CVSS score that indicates a high severity level due to its potential for DQL injection attacks.
How do I fix CVE-2017-5585?
To mitigate CVE-2017-5585, users should update to a newer version of OpenText Documentum Content Server or apply available patches.
What is DQL injection in relation to CVE-2017-5585?
DQL injection in CVE-2017-5585 refers to the ability of an attacker to manipulate DQL queries in order to execute unauthorized commands.
Who is affected by CVE-2017-5585?
CVE-2017-5585 specifically affects users of OpenText Documentum Content Server version 7.3 when using PostgreSQL as the database.
Can CVE-2017-5585 be exploited remotely?
Yes, CVE-2017-5585 can be exploited remotely by authenticated users, making it a significant vulnerability for organizations.