Skip to content

CVE-2017-7221 OpenText Documentum Content Server has an inadequate protection mechanism against SQL injection, which allows remote authenticated users to execute arbitrary code with super-user privileges by leverag...

HighCVSS 8.8 EPSS 4.3%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

OpenText Documentum Content Server has an inadequate protection mechanism against SQL injection, which allows remote authenticated users to execute arbitrary code with super-user privileges by leveraging the availability of the dm_bp_transition docbase method with a user-created dm_procedure object, as demonstrated by use of a backspace character in an injected string. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2513.

Affected products

ProductAffected versionsFixed in
opentext documentum content server All versions No fix listed

References

  • seclists.org exploit mailing-list third-party-advisory vdb-entry
  • 98038 third-party-advisory vdb-entry
  • 41928 exploit