CVE-2017-14759

EPSS 0.46%
Veröffentlicht 03.10.2017 01:29:02
Zuletzt bearbeitet 20.04.2025 01:37:25
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to an XML External Entity vulnerability: /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/. An unauthenticated user is able to read directory listings or system files, or cause SSRF or Denial of Service.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Opentext ≫ Document Sciences Xpression Updatesp1_p13 Version <= 4.5

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.46%	0.631

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774

Vendor Advisory

Permissions Required

http://seclists.org/fulldisclosure/2017/Sep/97

Third Party Advisory

Mailing List

https://nvd.nist.gov/vuln/detail/CVE-2017-14759

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2017-14759

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2017-14759

EUVD