CVE-2014-2504 Missing authorization in n/a
Authenticated users can bypass access restrictions to execute arbitrary DQL queries, potentially reading or modifying data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-2504?
CVE-2014-2504 is a critical missing authorization vulnerability in n/a, published on 23 May 2014. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language (DQL) queries by calling (1) a core method or (2) a D2FS web-service method.
Weakness: CWE-264
Which versions are affected by CVE-2014-2504?
It affects 1 product.
Products include Emc Documentum D2.
How do I fix CVE-2014-2504?
No fix has been published for CVE-2014-2504 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2014-2504 being exploited?
There is no known exploitation of CVE-2014-2504 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2015-0518 Privilege escalation in n/a
- CVE-2016-0888 Missing authorization in n/a
- CVE-2014-2515 Privilege escalation in n/a
- CVE-2016-9873 SQL injection in EMC Documentum D2 EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6
- CVE-2016-9872 Cross-site scripting in EMC Documentum D2 EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6
Sources
Also known as GHSA-qfp6-95mj-x23q.