Detections
Analytics
EMC Documentum Content Server Multiple Vulnerabilities (ESA-2014-046)
high Nessus Plugin ID 77633
Language:
Synopsis
The remote host is affected by multiple vulnerabilities.Description
The remote host is running a version of EMC Documentum Content Server that is affected by multiple vulnerabilities :- A privilege escalation vulnerability exists due to improper authorization checks. A remote, authenticated attacker can exploit this vulnerability to access data or execute commands with superuser privileges.
(CVE-2014-2506)
- A remote command injection vulnerability exists due to a failure to properly validate user input. A remote, authenticated attacker can exploit this vulnerability to inject arbitrary shell commands.
(CVE-2014-2507)
- An information disclosure vulnerability exists due to a flaw in the Documentum Query Language (DQL) engine. A remote, authenticated attacker can exploit this vulnerability to conduct DQL injection attacks and read arbitrary data from the database. (CVE-2014-2508)
Solution
Apply the relevant patch referenced in the vendor advisory.See Also
https://seclists.org/bugtraq/2014/Jun/att-50/ESA-2014-046.txt
Plugin Details
Severity: High
ID: 77633
File Name: emc_documentum_content_server_ESA-2014-046.nasl
Version: 1.3
Type: local
Agent: windows
Family: Windows
Published: 9/11/2014
Updated: 11/15/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 8.5
Temporal Score: 6.3
Vector: CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:emc:documentum_content_server
Required KB Items: installed_sw/EMC Documentum Content Server
Exploit Ease: No known exploits are available
Patch Publication Date: 6/6/2014
Vulnerability Publication Date: 6/16/2014