CVE-2014-2510
EMC Documentum Foundation Services - Authenticated XML External Entity Injection
Title source: llmDescription
The JAXB XML parser in EMC Documentum Foundation Services (DFS) 6.6 before P39, 6.7 SP1 before P28, and 6.7 SP2 before P15, as used in My Documentum for Desktop, My Documentum for Microsoft Outlook, and CenterStage, allows remote authenticated users to read arbitrary files via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
References (4)
Core 4
Core References
Permissions Required third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/59773
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/68434
Broken Link mailing-list
x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2014-07/0025.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1030528
Scores
EPSS
0.0050
EPSS Percentile
66.3%
Details
CWE
CWE-200
Status
published
Products (7)
emc/centerstage
1.2 sp1 (2 CPE variants)
emc/documentum_foundation_services
6.6
emc/documentum_foundation_services
6.7 (3 CPE variants)
emc/my_documentum_for_desktop
6.7.2
emc/my_documentum_for_microsoft_outlook
6.7 sp (2 CPE variants)
emc/my_documentum_for_microsoft_outlook
6.7.1
emc/my_documentum_for_microsoft_outlook
6.7.3
Published
Jul 08, 2014
Tracked Since
Feb 18, 2026