Improper input validation in EMC Documentum Digital Asset Manager
CVE-2014-2503
The thumbnail proxy server in EMC Documentum Digital Asset Manager (DAM) 6.5 SP3, 6.5 SP4, 6.5 SP5, and 6.5 SP6 before P13 allows remote attackers to conduct Documentum Query Language (DQL) injection attacks and bypass intended restrictions on querying objects via a crafted parameter in a query string.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.028 (85.0th percentile) — read the EPSS interpretation.
Affected products
- Emc Documentum_digital_asset_manager — versions 6.5
- N/a — versions n/a
Weakness classification (CWE)
References
- security_alert@emc.com (x_refsource_MISC)
- security_alert@emc.com (vdb-entry, x_refsource_SECTRACK)
- security_alert@emc.com (vdb-entry, x_refsource_BID)
- security_alert@emc.com (mailing-list, x_refsource_BUGTRAQ)