CVE-2017-7221

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-04-25 · updated 2026-06-17
Weakness: CWE-89

Description

OpenText Documentum Content Server has an inadequate protection mechanism against SQL injection, which allows remote authenticated users to execute arbitrary code with super-user privileges by leveraging the availability of the dm_bp_transition docbase method with a user-created dm_procedure object, as demonstrated by use of a backspace character in an injected string. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2513.

Affected products

OpenText Documentum Content Server: all versions

References

http://seclists.org/fulldisclosure/2017/Apr/97
http://www.securityfocus.com/bid/98038
https://www.exploit-db.com/exploits/41928/
http://seclists.org/fulldisclosure/2017/Apr/97
http://www.securityfocus.com/bid/98038
https://www.exploit-db.com/exploits/41928/

Get alerted when CVE-2017-7221 or the next vulnerability affects your stack