CVE-2017-14524

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-09-28 · updated 2026-06-17
Weakness: CWE-601

Description

Multiple open redirect vulnerabilities in OpenText Documentum Administrator 7.2.0180.0055 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a (1) URL in the startat parameter to xda/help/en/default.htm or (2) /%09/ (slash encoded horizontal tab slash) followed by a domain in the redirectUrl parameter to xda/component/virtuallinkconnect.

Affected products

OpenText Documentum Administrator: 7.2.0180.0055
OpenText™ Documentum Webtop: 6.8.0160.0073

References

http://seclists.org/fulldisclosure/2017/Sep/57
https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774
http://seclists.org/fulldisclosure/2017/Sep/57
https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774

Get alerted when CVE-2017-14524 or the next vulnerability affects your stack