Arbitrary file upload in EMC Documentum Administrator
CVE-2015-4524
Unrestricted file upload vulnerability in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before P23, 7.0 before P18, 7.1 before P15, and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before P25; Documentum Web Publishers 6.5 SP7 before P25; and Documentum Task Space 6.7SP1 before P31 and 6.7SP2 before P23 allows remote authenticated users to execute arbitrary code by uploading a file to the backend Content Server.
Vulnerability class: Unrestricted File Upload
EPSS: 0.024 (82.3th percentile) — read the EPSS interpretation.
Affected products
- Emc Documentum_administrator — versions 6.7, 7.0, 7.1
- Emc Documentum_digital_asset_manager — versions 6.5
- Emc Documentum_taskspace — versions 6.7
- Emc Documentum_web_publisher — versions 6.5
- Emc Documentum_webtop — versions 6.7, 6.8
- N/a — versions n/a
Weakness classification (CWE)
References
- security_alert@emc.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- security_alert@emc.com (mailing-list, x_refsource_BUGTRAQ, Mailing List, Third Party Advisory)