CVE-2017-15276
CVSS V2 Medium 6.5
CVSS V3 High 8.8
Description
OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows an authenticated user to gain superuser privileges: Content Server allows uploading content using batches (TAR archives). When unpacking TAR archives, Content Server fails to verify the contents of an archive, which causes a path traversal vulnerability via symlinks. Because some files on the Content Server filesystem are security-sensitive, this leads to privilege escalation.
Overview
- CVE ID
- CVE-2017-15276
- Assigner
- cve@mitre.org
- Vulnerability Status
- Modified
- Published Version
- 2017-10-13T16:29:00
- Last Modified Date
- 2017-11-03T01:29:05
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:opentext:documentum_content_server:*:*:*:*:*:*:*:* | 1 | OR | 7.3 |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:L/Au:S/C:P/I:P/A:P
- Access Vector
- NETWORK
- Access Compatibility
- LOW
- Authentication
- SINGLE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- PARTIAL
- Availability Impact
- PARTIAL
- Base Score
- 6.5
- Severity
- MEDIUM
- Exploitability Score
- 8
- Impact Score
- 6.4
CVSS Version 3
- Version
- 3.0
- Vector String
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 8.8
- Base Severity
- HIGH
- Exploitability Score
- 2.8
- Impact Score
- 5.9
References
| Reference URL | Reference Tags |
|---|---|
| http://seclists.org/bugtraq/2017/Oct/19 | Mailing List Third Party Advisory VDB Entry |
| https://www.exploit-db.com/exploits/43002/ | |
| http://www.securityfocus.com/bid/101639 |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2017-15276 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15276 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 08:12:47 | Added to TrackCVE | |||
| 2022-12-02 21:57:49 | 2017-10-13T16:29Z | 2017-10-13T16:29:00 | CVE Published Date | updated |
| 2022-12-02 21:57:49 | 2017-11-03T01:29:05 | CVE Modified Date | updated | |
| 2022-12-02 21:57:49 | Modified | Vulnerability Status | updated |