CVE-2017-14754
OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to Arbitrary File Read: /xAdmin/html/cm_datasource_group_xsd.jsp, parameter: xsd_datasource_schema_file…
Does this matter?
Lower severity and a low EPSS score (1.30%). Track it; it rarely justifies an emergency change on its own.
Description
OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to Arbitrary File Read: /xAdmin/html/cm_datasource_group_xsd.jsp, parameter: xsd_datasource_schema_file filename. In order for this vulnerability to be exploited, an attacker must authenticate to the application first.
- CVSS 3.0
- 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.30% probability · 69th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- opentext/document sciences xpression
- Source
- cve@mitre.org
References
- http://seclists.org/fulldisclosure/2017/Sep/92Mailing List, Third Party Advisory
- https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774Permissions Required, Vendor Advisory
- http://seclists.org/fulldisclosure/2017/Sep/92Mailing List, Third Party Advisory
- https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774Permissions Required, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.