OpenText Documentum Content Server (formerly EMC Documentum Content Server) 7.3, when PostgreSQL Database is used and returntopresultsrowbased config option is false, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and execute arbitrary DML or DDL commands via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2520.

OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows an authenticated user to gain superuser privileges: Content Server stores information about uploaded files in dmrcontent objects, which are queryable and "editable" (before release 7.2P02, any authenticated user was able to edit dmrcontent objects; now any authenticated user may delete a dmrcontent object and then create a new one with the old identifier) by authenticated users; this allows any authenticated user to replace the content of security-sensitive dmrcontent objects (for example, dmrcontent related to dmmethod objects) and gain superuser privileges.

OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 does not properly validate the input of the PUTFILE RPC-command, which allows any authenticated user to hijack an arbitrary file from the Content Server filesystem; because some files on the Content Server filesystem are security-sensitive, this leads to privilege escalation.

OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows authenticated users to download arbitrary content files regardless of the attacker's repository permissions: When an authenticated user uploads content to the repository, he performs the following steps: (1) calls the STARTPUSH RPC-command; (2) uploads the file to the content server; (3) calls the ENDPUSHV2 RPC-command (here, Content Server returns a DATATICKET integer, intended to identify the location of the uploaded file on the Content Server filesystem); (4) creates a dmrcontent object in the repository, which has a value of dataticket equal to the value of DATATICKET returned at the end of ENDPUSHV2 call. As the result of this design, any authenticated user may create his own dmrcontent object, pointing to already existing content in the Content Server filesystem.