CVE-2017-14527 Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Webtop 6.8.0160.0073 allow remote authenticated users to list the contents of arbitrary directories, read arbitrary files,...
HighCVSS 8.8
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Webtop 6.8.0160.0073 allow remote authenticated users to list the contents of arbitrary directories, read arbitrary files, cause a denial of service, or, on Windows, obtain Documentum user hashes via a (1) crafted DTD, involving unspecified XML structures in a request to xda/com/documentum/ucf/server/transport/impl/GAIRConnector or crafted XML file in a MediaProfile file (2) import or (3) check in.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opentext documentum administrator | = 7.2.0180.0055 | No fix listed |
| opentext documentum webtop | = 6.8.0160.0073 | No fix listed |
References
- 20170925 OpenText Documentum Administrator and Webtop - XML External Entity Injection exploit mailing-list third-party-advisory
- knowledge.opentext.com permissions-required