CVE-2017-7220

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

OpenText Documentum Content Server allows superuser access via sys_obj_save or save of a crafted object, followed by an unauthorized "UPDATE dm_dbo.dm_user_s SET user_privileges=16" command, aka an "RPC save-commands" attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4532.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/bugtraq/2017/Apr/61Exploit, Mailing List, Third Party Advisory
https://gist.github.com/andreybpanfilov/d8792484e13971982c0719ae59ab8c7cExploit, Third Party Advisory
https://gist.github.com/andreybpanfilov/e0e60ae9d525a34cca04eb4c89a21e04Exploit, Third Party Advisory
http://seclists.org/bugtraq/2017/Apr/61Exploit, Mailing List, Third Party Advisory
https://gist.github.com/andreybpanfilov/d8792484e13971982c0719ae59ab8c7cExploit, Third Party Advisory
https://gist.github.com/andreybpanfilov/e0e60ae9d525a34cca04eb4c89a21e04Exploit, Third Party Advisory

Timeline

Published: Apr 21, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-72218.8OpenText Documentum Content Server has an inadequate protection mechanism against SQL injection, which allows remote authenticated users to CVE-2017-72226.1A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript (if Manti CVE-2017-72237.5GNU assembler in GNU Binutils 2.28 is vulnerable to a global buffer overflow (of size 1) while attempting to unget an EOF character from the CVE-2017-72245.5The find_nearest_line function in objdump in GNU Binutils 2.28 is vulnerable to an invalid write (of size 1) while disassembling a corrupt b CVE-2017-72257.5The find_nearest_line function in addr2line in GNU Binutils 2.28 does not handle the case where the main file name and the directory name ar CVE-2017-72269.1The pe_ILF_object_p function in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to CVE-2017-72277.5GNU linker (ld) in GNU Binutils 2.28 is vulnerable to a heap-based buffer overflow while processing a bogus input script, leading to a progr CVE-2017-72288.2An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix in CVE-2017-72299.1PGP/MIME encrypted messages injected into a Vaultive O365 (before 4.5.21) frontend via IMAP or SMTP have their Content-Type changed from 'Co CVE-2017-72309.8A buffer overflow vulnerability in Disk Sorter Enterprise 9.5.12 and earlier allows remote attackers to execute arbitrary code via a GET req CVE-2017-72317.8pngdefry through 2017-03-22 is prone to a heap-based buffer-overflow vulnerability because it fails to properly process a specially crafted CVE-2017-72336.1Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on succes