CVE-2014-2504 EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary....
HighCVSS 9.0
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language (DQL) queries by calling (1) a core method or (2) a D2FS web-service method.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| emc documentum d2 | = 3.1 | No fix listed |
| emc documentum d2 | = 3.1-sp1 | No fix listed |
| emc documentum d2 | = 4.0 | No fix listed |
| emc documentum d2 | = 4.1 | No fix listed |
| emc documentum d2 | = 4.2 | No fix listed |
References
- 20140522 ESA-2014-045: EMC Documentum D2 Arbitrary DQL Query Execution Vulnerability mailing-list
- 58938 third-party-advisory
- 1030282 vdb-entry