ID CVE-2016-0882
Summary EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to read arbitrary files via a POST request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. <a href="http://cwe.mitre.org/data/definitions/611.html">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a>
References
Vulnerable Configurations
  • cpe:2.3:a:emc:documentum_xcp:2.1:*:*:*:*:*:*:*
    cpe:2.3:a:emc:documentum_xcp:2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:emc:documentum_xcp:2.2:*:*:*:*:*:*:*
    cpe:2.3:a:emc:documentum_xcp:2.2:*:*:*:*:*:*:*
CVSS
Base: 5.5 (as of 11-01-2017 - 04:11)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:S/C:P/I:N/A:P
refmap via4
bugtraq 20160209 ESA-2016-010 EMC Documentum xCP Security Update for Multiple Vulnerabilities
sectrack 1034993
Last major update 11-01-2017 - 04:11
Published 12-02-2016 - 01:59
Last modified 11-01-2017 - 04:11
Back to Top