{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-08-18T00:00:00", "descriptions": [{"lang": "en", "value": "EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07, when Oracle Database is used, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and read sensitive database content via a crafted request."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01", "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell"}, "references": [{"name": "1030743", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1030743"}, {"name": "emc-documentum-cve20142520-dql-injection(95369)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95369"}, {"name": "20140818 ESA-2014-079: EMC Documentum Content Server Multiple Vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/533162/30/0/threaded"}, {"name": "60571", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/60571"}, {"name": "69274", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/69274"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security_alert@emc.com", "ID": "CVE-2014-2520", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07, when Oracle Database is used, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and read sensitive database content via a crafted request."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "1030743", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1030743"}, {"name": "emc-documentum-cve20142520-dql-injection(95369)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95369"}, {"name": "20140818 ESA-2014-079: EMC Documentum Content Server Multiple Vulnerabilities", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/533162/30/0/threaded"}, {"name": "60571", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/60571"}, {"name": "69274", "refsource": "BID", "url": "http://www.securityfocus.com/bid/69274"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T10:14:26.572Z"}, "title": "CVE Program Container", "references": [{"name": "1030743", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1030743"}, {"name": "emc-documentum-cve20142520-dql-injection(95369)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95369"}, {"name": "20140818 ESA-2014-079: EMC Documentum Content Server Multiple Vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/533162/30/0/threaded"}, {"name": "60571", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/60571"}, {"name": "69274", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/69274"}]}]}, "cveMetadata": {"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "assignerShortName": "dell", "cveId": "CVE-2014-2520", "datePublished": "2014-08-20T10:00:00", "dateReserved": "2014-03-14T00:00:00", "dateUpdated": "2024-08-06T10:14:26.572Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:emc:documentum_content_server:*:sp2:*:*:*:*:*:*", "matchCriteriaId": "D76BC7EC-B77D-4C40-AC45-347EC6618C94", "versionEndIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:emc:documentum_content_server:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "FDBAEC8D-D945-48CA-84DD-EDBE8029F636", "vulnerable": true}, {"criteria": "cpe:2.3:a:emc:documentum_content_server:6.5:*:*:*:*:*:*:*", "matchCriteriaId": "730510E9-1AE8-44BF-A1DE-5ED40F22D0B6", "vulnerable": true}, {"criteria": "cpe:2.3:a:emc:documentum_content_server:6.5:sp1:*:*:*:*:*:*", "matchCriteriaId": "CC8840D2-5DE8-4EB6-A03F-BFF1C8A9BF1B", "vulnerable": true}, {"criteria": "cpe:2.3:a:emc:documentum_content_server:6.5:sp2:*:*:*:*:*:*", "matchCriteriaId": "3AC51C95-97DC-44B4-9935-9423CE60289A", "vulnerable": true}, {"criteria": "cpe:2.3:a:emc:documentum_content_server:6.5:sp3:*:*:*:*:*:*", "matchCriteriaId": "0ACB8EDE-C6AF-4B85-83ED-74097A206B49", "vulnerable": true}, {"criteria": "cpe:2.3:a:emc:documentum_content_server:6.6:*:*:*:*:*:*:*", "matchCriteriaId": "25CD1EE0-4E72-4C42-857B-AA45F0A17BBB", "vulnerable": true}, {"criteria": "cpe:2.3:a:emc:documentum_content_server:6.7:-:*:*:*:*:*:*", "matchCriteriaId": "49659818-958F-4B5E-8DA4-B592C67DD13F", "vulnerable": true}, {"criteria": "cpe:2.3:a:emc:documentum_content_server:6.7:sp1:*:*:*:*:*:*", "matchCriteriaId": "414C33C7-CD76-49A4-9BE5-354860F2F635", "vulnerable": true}, {"criteria": "cpe:2.3:a:emc:documentum_content_server:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "8335062A-5A8E-4076-B351-7DFA19CEC818", "vulnerable": true}, {"criteria": "cpe:2.3:a:emc:documentum_content_server:7.1:*:*:*:*:*:*:*", "matchCriteriaId": "B283F797-6DAA-40E1-9FAB-16FCAA5241B4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07, when Oracle Database is used, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and read sensitive database content via a crafted request."}, {"lang": "es", "value": "EMC Documentum Content Server anterior a 6.7 SP2 P16 y 7.x anterior a 7.1 P07, cuando Oracle Database est\u00e1 utilizada, no restringe debidamente los hints DQL, lo que permite a usuarios remotos autenticados realizar ataques de inyecci\u00f3n DQL y leer contenido sensible de la base de datos a trav\u00e9s de una solicitud manipulada."}], "id": "CVE-2014-2520", "lastModified": "2017-08-29T01:34:31.437", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 6.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:S/C:C/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-08-20T11:17:13.953", "references": [{"source": "security_alert@emc.com", "url": "http://secunia.com/advisories/60571"}, {"source": "security_alert@emc.com", "url": "http://www.securityfocus.com/archive/1/533162/30/0/threaded"}, {"source": "security_alert@emc.com", "url": "http://www.securityfocus.com/bid/69274"}, {"source": "security_alert@emc.com", "url": "http://www.securitytracker.com/id/1030743"}, {"source": "security_alert@emc.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95369"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}