CVE-2017-14758
high
CVSS v3
8.8
CVSS v2
6.5
VIR risk
8.8
Description
OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to SQL Injection: /xAdmin/html/cm_doclist_view_uc.jsp, parameter: documentId. In order for this vulnerability to be exploited, an attacker must authenticate to the application first.
Predictions
Exploit likelihood
92%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cve@mitre.org — https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| opentext | document_sciences_xpression | {"endIncluding":"4.5"} | |
References
- http://seclists.org/fulldisclosure/2017/Oct/23
- https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774
- https://www.exploit-db.com/exploits/42940/
- http://seclists.org/fulldisclosure/2017/Oct/23
- https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774
- https://www.exploit-db.com/exploits/42940/
CWEs
CWE-89
Verify integrity in audit chain (admin only). AS-IS.