VulnerabilityModified
CVE-2014-2520
EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07, when Oracle Database is used, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and read sensitive database content via…
MEDIUM 6.3EPSS 1.71%
Does this matter?
Lower severity and a low EPSS score (1.71%). Track it; it rarely justifies an emergency change on its own.
Description
EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07, when Oracle Database is used, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and read sensitive database content via a crafted request.
- CVSS 2.0
- 6.3 MEDIUMAV:N/AC:M/Au:S/C:C/I:N/A:N
- EPSS
- 1.71% probability · 76th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- emc/documentum content server
- Source
- security_alert@emc.com
References
- http://secunia.com/advisories/60571
- http://www.securityfocus.com/archive/1/533162/30/0/threaded
- http://www.securityfocus.com/bid/69274
- http://www.securitytracker.com/id/1030743
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95369
- http://secunia.com/advisories/60571
- http://www.securityfocus.com/archive/1/533162/30/0/threaded
- http://www.securityfocus.com/bid/69274
- http://www.securitytracker.com/id/1030743
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95369
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.