CWE Code: 269
Vulnerability Type: privilege_escalation
CVSS Score: 6.5
CWE Name:  Improper Privilege Management
Summary: opentext documentum content server (formerly emc documentum content server) through 7.3 contains the following design gap, which allows an authenticated user to gain superuser privileges: content server stores information about uploaded files in dmr_content objects, which are queryable and "editable" (before release 7.2p02, any authenticated user was able to edit dmr_content objects; now any authenticated user may delete a dmr_content object and then create a new one with the old identifier) by authenticated users; this allows any authenticated user to replace the content of security-sensitive dmr_content objects (for example, dmr_content related to dm_method objects) and gain superuser privileges.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2017-10-13
Last Modified Date: 2019-10-03