CVE-2016-0882

EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to read arbitrary files via a POST request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Score

CVSS 3.0 5.4 Medium

Status

Modified - security_alert@emc.com

Published

2016-02-12

Last modified

2024-08-05

Affected products

• Documentum Xcp (Emc)

References

• http://seclists.org/bugtraq/2016/Feb/66
• http://www.securitytracker.com/id/1034993