NVD Vulnerability Detail

CVE-2013-6177

Summary	Directory traversal vulnerability in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allows remote authenticated users to read arbitrary files by leveraging xDashboard access.
Publication Date	Nov. 21, 2013, 1:40 p.m.
Registration Date	Jan. 26, 2021, 3:47 p.m.
Last Update	Nov. 21, 2024, 10:58 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:emc:document_sciences_xpression:4.2:-:-:*:enterprise:-:-:compuset_engine
cpe:2.3:a:emc:document_sciences_xpression:4.5:-:-:*:enterprise:-:-:compuset_engine
cpe:2.3:a:emc:document_sciences_xpression:4.1:sp1:-:*:enterprise:-:-:compuset_engine

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:emc:document_sciences_xpression:4.1:sp1:-:*:enterprise:-:-:publish_engine
cpe:2.3:a:emc:document_sciences_xpression:4.5:-:-:*:enterprise:-:-:publish_engine
cpe:2.3:a:emc:document_sciences_xpression:4.2:-:-:*:enterprise:-:-:publish_engine

Configuration3	or higher	or less	more than	less than
cpe:2.3:a:emc:document_sciences_xpression:4.1:sp1:-::documentum:::
cpe:2.3:a:emc:document_sciences_xpression:4.2:-:-::documentum:::
cpe:2.3:a:emc:document_sciences_xpression:4.5:-:-::documentum:::

Related information, measures and tools

No	URL	タグ
1	http://archives.neohapsis.com/archives/bugtraq/2013-11/0095.html
2	http://archives.neohapsis.com/archives/bugtraq/2013-11/0095.html
3	http://packetstormsecurity.com/files/124070/EMC-Document-Sciences-xPression-XSS-CSRF-Redirect-SQL-Injection.html
4	http://packetstormsecurity.com/files/124070/EMC-Document-Sciences-xPression-XSS-CSRF-Redirect-SQL-Injection.html
5	http://www.kb.cert.org/vuls/id/346982	US Government Resource
6	http://www.kb.cert.org/vuls/id/346982	US Government Resource
7	http://www.securitytracker.com/id/1029384
8	http://www.securitytracker.com/id/1029384

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-22	パス・トラバーサル	https://cwe.mitre.org/data/definitions/22.html

JVN Vulnerability Information

EMC Document Sciences xPression の複数の Edition におけるディレクトリトラバーサルの脆弱性

Title	EMC Document Sciences xPression の複数の Edition におけるディレクトリトラバーサルの脆弱性
Summary	EMC Document Sciences xPression の Documentum Edition、Enterprise Edition Publish Engine、および Enterprise Edition Compuset Engine には、ディレクトリトラバーサルの脆弱性が存在します。
Possible impacts	リモート認証されたユーザにより、xDashboard のアクセスを利用されることで、任意のファイルを読まれる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Nov. 19, 2013, midnight
Registration Date	Nov. 22, 2013, 4:56 p.m.
Last Update	Dec. 4, 2013, 12:22 p.m.

Affected System

DELL EMC (旧 EMC Corporation)

EMC Document Sciences xPression 4.1 SP1 Patch 47 未満の 4.1 SP1

EMC Document Sciences xPression 4.2 Patch 26 未満の 4.2

EMC Document Sciences xPression 4.5 Patch 05 未満の 4.5

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-6177	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6177
National Vulnerability Database (NVD)
2	CVE-2013-6177	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6177

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-22	https://jvndb.jvn.jp/ja/cwe/CWE-22.html

ベンダー情報

No	Name	URL
EMC Corporation
1	DOCUMENT SCIENCES	http://japan.emc.com/enterprise-content-management/document-sciences/document-sciences.htm
2	User Downloads	http://www.docscience.com/support/downloads.htm

その他

No	Name	URL
JVN
1	JVNVU#91968905	http://jvn.jp/cert/JVNVU91968905/
US-CERT Vulnerability Note
2	VU#346982	http://www.kb.cert.org/vuls/id/346982
関連文書
3	ESA-2013-078	http://archives.neohapsis.com/archives/bugtraq/2013-11/att-0095/ESA-2013-078.txt
4	SecurityFocus - ESA-2013-078: EMC Document Sciences xPression Multiple Vulnerabilities	http://www.securityfocus.com/archive/1/529893/30/0/threaded

Change Log

No	Changed Details	Date of change
0	[2013年11月22日] 掲載 [2013年12月04日] ベンダ情報：EMC Corporation (User Downloads) を追加参考情報：JVN (JVNVU#91968905) を追加参考情報：US-CERT Vulnerability Note (VU#346982) を追加参考情報：関連文書 (SecurityFocus - ESA-2013-078: EMC Document Sciences xPression Multiple Vulnerabilities) を追加	Feb. 17, 2018, 10:37 a.m.