What’s Vulnerable › Vulnerabilities

CVE-2017-5585

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-02-22 · updated 2026-06-17
• Weakness: CWE-74

Description

OpenText Documentum Content Server (formerly EMC Documentum Content Server) 7.3, when PostgreSQL Database is used and return_top_results_row_based config option is false, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and execute arbitrary DML or DDL commands via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2520.

Affected products

• OpenText Documentum Content Server: 7.3

References

• http://packetstormsecurity.com/files/141124/OpenText-Documentum-Content-Server-7.3-SQL-Injection.html
• http://www.securityfocus.com/bid/96224
• http://packetstormsecurity.com/files/141124/OpenText-Documentum-Content-Server-7.3-SQL-Injection.html
• http://www.securityfocus.com/bid/96224

Get alerted when CVE-2017-5585 or the next vulnerability affects your stack