CVE-2017-14526

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.16%

Published

Sep 27, 2017

Modified

May 12, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Administrator 7.2.0180.0055 allow remote authenticated users to list the contents of arbitrary directories, read arbitrary files, cause a denial of service, or, on Windows, obtain Documentum user hashes via a (1) crafted DTD, involving unspecified XML structures in a request to xda/com/documentum/ucf/server/transport/impl/GAIRConnector or crafted XML file in a MediaProfile file (2) import or (3) check in.

Weaknesses (CWE)

CWE-611

Affected Products (2)

opentext · documentum_administratorvulnerable

opentext · documentum_webtopvulnerable

References (4)

http://seclists.org/fulldisclosure/2017/Sep/58

Mailing ListThird Party Advisory

https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774

Permissions RequiredVendor Advisory

http://seclists.org/fulldisclosure/2017/Sep/58

Mailing ListThird Party Advisory

https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774

Permissions RequiredVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs