OpenText Documentum Content Server CVE-2017-7221 Incomplete Fix Remote Code Execution Vulnerability

Bugtraq ID:	98038
Class:	Input Validation Error
CVE:	CVE-2017-7221
Remote:	Yes
Local:	No
Published:	Apr 25 2017 12:00AM
Updated:	May 02 2017 02:10AM
Credit:	Andrey B. Panfilov.
Vulnerable:	OpenText Documentum Content Server 0
Not Vulnerable:

OpenText Documentum Content Server CVE-2017-7221 Incomplete Fix Remote Code Execution Vulnerability

OpenText Documentum Content Server is prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.

Note : This issue is the result of an incomplete fix described in BID 68435 (EMC Documentum Content Server CVE-2014-2513 Remote Privilege Escalation Vulnerability).

OpenText Documentum Content Server CVE-2017-7221 Incomplete Fix Remote Code Execution Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information

OpenText Documentum Content Server CVE-2017-7221 Incomplete Fix Remote Code Execution Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

OpenText Documentum Content Server CVE-2017-7221 Incomplete Fix Remote Code Execution Vulnerability

References:

• CVE-2017-7221. OpenText Documentum Content Server: arbitrary code execution in d (Seclists)
  
• CVE-2017-7221.py (Github)