EMC Documentum eRoom Multiple HTML Injection Vulnerabilities

Bugtraq ID:	52441
Class:	Input Validation Error
CVE:	CVE-2012-0404
Remote:	Yes
Local:	No
Published:	Mar 13 2012 12:00AM
Updated:	Mar 15 2012 09:40PM
Credit:	SEC Consult
Vulnerable:	EMC Documentum eRoom 7.4.2 EMC Documentum eRoom 7.4.1 EMC Documentum eRoom 7.4.3g EMC Documentum eRoom 7.4.3.f EMC Documentum eRoom 7.4.3.f EMC Documentum eRoom 7.4.3 EMC Documentum eRoom 7.4.3 EMC Documentum eRoom 7.3
Not Vulnerable:	EMC Documentum eRoom 7.4.4

EMC Documentum eRoom Multiple HTML Injection Vulnerabilities

EMC Documentum eRoom is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials, or control how the site is rendered to the user. Other attacks are also possible.

EMC Documentum eRoom versions prior to 7.4.4 are vulnerable.

EMC Documentum eRoom Multiple HTML Injection Vulnerabilities

An attacker can use a browser to exploit these issues. Please see the references for examples.

EMC Documentum eRoom Multiple HTML Injection Vulnerabilities

Solution:
Vendor updates are available. Please see the referenced advisories for more information.

EMC Documentum eRoom Unspecified Cross Site Scripting Vulnerability

References:

• EMC Documentum eRoom Homepage (EMC)
  
• ESA-2012-012: EMC Documentum eRoom Multiple Vulnerabilities ([email protected])