CWE Code: 74
Vulnerability Type: sql_injection
CVSS Score: 6.5
CWE Name:  Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Summary: opentext documentum content server (formerly emc documentum content server) 7.3, when postgresql database is used and return_top_results_row_based config option is false, does not properly restrict dql hints, which allows remote authenticated users to conduct dql injection attacks and execute arbitrary dml or ddl commands via a crafted request.  note: this vulnerability exists because of an incomplete fix for cve-2014-2520.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2017-02-22
Last Modified Date: 2017-03-02