Multiple EMC Documentum Products CVE-2013-0939 Cross Domain Information Disclosure Vulnerability

Bugtraq ID:	59795
Class:	Origin Validation Error
CVE:	CVE-2013-0939
Remote:	Yes
Local:	No
Published:	May 09 2013 12:00AM
Updated:	May 09 2013 12:00AM
Credit:	EMC
Vulnerable:	EMC Documentum Webtop 6.7 SP1 EMC Documentum WDK 6.7 SP1 EMC Documentum Taskspace 6.7 SP1 EMC Documentum Records Manager 6.7 SP1
Not Vulnerable:	EMC Documentum Webtop 6.7 SP2 EMC Documentum WDK 6.7 SP2 EMC Documentum Taskspace 6.7 SP2 EMC Documentum Records Manager 6.7 SP2

Multiple EMC Documentum Products CVE-2013-0939 Cross Domain Information Disclosure Vulnerability

Multiple EMC Documentum products are prone to a cross domain information disclosure vulnerability.

Successful exploits will allow attackers to bypass the same-origin policy and obtain potentially sensitive information; other attacks are possible.

The following products and versions are vulnerable:

EMC Documentum Webtop versions prior to 6.7 SP2
EMC Documentum WDK versions prior to 6.7 SP2
EMC Documentum Taskspace versions prior to 6.7 SP2
EMC Documentum Records Manager versions prior to 6.7 SP2

Multiple EMC Documentum Products CVE-2013-0939 Cross Domain Information Disclosure Vulnerability

Attackers can exploit this issue by tricking an unsuspecting victim into visiting a malicious web page.

Multiple EMC Documentum Products CVE-2013-0939 Cross Domain Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple EMC Documentum Products CVE-2013-0939 Cross Domain Information Disclosure Vulnerability

References:

• EMC Homepage (EMC)
  
• ESA-2013-021: EMC Documentum Multiple Vulnerabilities (Bugtraq)