Opentext Documentum Administrator 7.2.0180.0055 GAIRConnector XML File xml external entity reference

Summaryinfo

A vulnerability was found in Opentext Documentum Administrator 7.2.0180.0055. It has been classified as critical. This affects an unknown function of the file xda/com/documentum/ucf/server/transport/impl/GAIRConnector. This manipulation as part of XML File causes xml external entity reference. This vulnerability appears as CVE-2017-14526. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability has been found in Opentext Documentum Administrator 7.2.0180.0055 and classified as critical. Affected by this vulnerability is an unknown code block of the file xda/com/documentum/ucf/server/transport/impl/GAIRConnector. The manipulation as part of a XML File leads to a xml external entity reference vulnerability. The CWE definition for the vulnerability is CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. As an impact it is known to affect confidentiality, and availability. The summary by CVE is:

Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Administrator 7.2.0180.0055 allow remote authenticated users to list the contents of arbitrary directories, read arbitrary files, cause a denial of service, or, on Windows, obtain Documentum user hashes via a (1) crafted DTD, involving unspecified XML structures in a request to xda/com/documentum/ucf/server/transport/impl/GAIRConnector or crafted XML file in a MediaProfile file (2) import or (3) check in.

The bug was discovered 09/24/2017. The weakness was presented 09/28/2017 as not defined mailinglist post (Full-Disclosure). It is possible to read the advisory at seclists.org. This vulnerability is known as CVE-2017-14526 since 09/17/2017. The exploitation appears to be easy. The attack can be launched remotely. The requirement for exploitation is a single authentication. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability was handled as a non-public zero-day exploit for at least 3 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-107201, VDB-107202 and VDB-107204 for similar entries. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Opentext

Name

• Documentum Administrator

Version

• 7.2.0180.0055

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion