EMC Documentum Content Server Multiple Vulnerabilities (ESA-2014-046)

High Nessus Plugin ID 77633


The remote host is affected by multiple vulnerabilities.


The remote host is running a version of EMC Documentum Content Server that is affected by multiple vulnerabilities :

- A privilege escalation vulnerability exists due to improper authorization checks. A remote, authenticated attacker can exploit this vulnerability to access data or execute commands with superuser privileges.

- A remote command injection vulnerability exists due to a failure to properly validate user input. A remote, authenticated attacker can exploit this vulnerability to inject arbitrary shell commands.

- An information disclosure vulnerability exists due to a flaw in the Documentum Query Language (DQL) engine. A remote, authenticated attacker can exploit this vulnerability to conduct DQL injection attacks and read arbitrary data from the database. (CVE-2014-2508)


Apply the relevant patch referenced in the vendor advisory.

See Also


Plugin Details

Severity: High

ID: 77633

File Name: emc_documentum_content_server_ESA-2014-046.nasl

Version: $Revision: 1.1 $

Type: local

Agent: windows

Family: Windows

Published: 2014/09/11

Modified: 2014/09/11

Dependencies: 77631

Risk Information

Risk Factor: High


Base Score: 8.5

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:emc:documentum_content_server

Required KB Items: installed_sw/EMC Documentum Content Server

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2014/06/06

Vulnerability Publication Date: 2014/06/16

Reference Information

CVE: CVE-2014-2506, CVE-2014-2507, CVE-2014-2508

BID: 67916, 67917, 67918

OSVDB: 107748, 107749, 107750