XSS in EMC Documentum Administrator
CVE-2013-3281
Cross-site scripting (XSS) vulnerability in EMC Documentum Webtop before 6.7 SP2 P07, Documentum WDK before 6.7 SP2 P07, Documentum Taskspace before 6.7 SP2 P07, Documentum Records Manager before 6.7 SP2 P07, Documentum Web Publisher before 6.5 SP7, Documentum Digital Asset Manager before 6.5 SP6, Documentum Administrator before 6.7 SP2 P07, and Documentum Capital Projects before 1.8 P01 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter in a URL.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 4.3 (Medium). Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.010 (61.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 61st percentile — 61.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- EMC Documentum Administrator — versions 6.7
- EMC Documentum Capital Projects
- EMC Documentum Digital Asset Manager — versions 6.5
- EMC Documentum Taskspace — versions 6.7
- EMC Documentum Wdk — versions 6.7
- EMC Documentum Web Publisher — versions 6.5
- EMC Documentum Webtop — versions 6.7
Weakness classification (CWE)
References
- www.kb.cert.org/vuls/id/466876 (US Government Resource, third-party-advisory)
- archives.neohapsis.com/archives/bugtraq/2013-11/0018.html (mailing-list)