EMC Document Sciences xPression CVE-2013-6173 Multiple Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	63807
Class:	Design Error
CVE:	CVE-2013-6173
Remote:	Yes
Local:	No
Published:	Nov 19 2013 12:00AM
Updated:	Dec 10 2013 12:56AM
Credit:	Sertan Kolat and Omer Coskun
Vulnerable:
Not Vulnerable:

EMC Document Sciences xPression CVE-2013-6173 Multiple Cross Site Request Forgery Vulnerabilities

EMC Document Sciences xPression is prone to multiple cross-site request-forgery vulnerabilities because it fails to properly validate HTTP requests.

An attacker can exploit these issues to perform administrative actions in the context of a logged-in user. This may aid in other attacks.

The following products are vulnerable:

EMC Document Sciences xPression Documentum Edition 4.1 SP1, 4.2, and 4.5
EMC Document Sciences xPression Enterprise Edition 4.1 SP1, 4.2, and 4.5

EMC Document Sciences xPression CVE-2013-6173 Multiple Cross Site Request Forgery Vulnerabilities

To exploit these issues an attacker must entice an unsuspecting victim to open a malicious URI.

EMC Document Sciences xPression CVE-2013-6173 Multiple Cross Site Request Forgery Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

EMC Document Sciences xPression CVE-2013-6173 Multiple Cross Site Request Forgery Vulnerabilities

References:

• EMC Homepage (EMC)