High severity8.8NVD Advisory· Published Feb 22, 2017· Updated Jun 17, 2026
CVE-2017-5585
CVE-2017-5585
Description
OpenText Documentum Content Server (formerly EMC Documentum Content Server) 7.3, when PostgreSQL Database is used and return_top_results_row_based config option is false, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and execute arbitrary DML or DDL commands via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2520.
Affected products
2cpe:2.3:a:opentext:documentum_content_server:7.3:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:opentext:documentum_content_server:7.3:*:*:*:*:*:*:*
- (no CPE)range: 7.3
Patches
Vulnerability mechanics
References
2- packetstormsecurity.com/files/141124/OpenText-Documentum-Content-Server-7.3-SQL-Injection.htmlnvdExploitThird Party Advisory
- www.securityfocus.com/bid/96224nvdThird Party AdvisoryVDB Entry
News mentions
0No linked articles in our index yet.