CVE-2014-3138
published 2014-05-02CVE-2014-3138: SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote…
PriorityP341medium6.5CVSS 2.0
AVNACLAuSCPIPAP
EXPLOIT
EPSS
2.71%
84.1th percentile
SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote authenticated users to execute arbitrary SQL commands via the PATH_INFO to /docushare/dsweb/ResultBackgroundJobMultiple/. NOTE: some of these details are obtained from third party information.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xerox | docushare | — | — |
| xerox | docushare | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/126171/Xerox-DocuShare-SQL-Injection.htmlhttp://seclists.org/fulldisclosure/2014/Apr/205http://secunia.com/advisories/57996http://www.exploit-db.com/exploits/32886http://www.osvdb.org/105972http://www.securityfocus.com/bid/66922http://www.xerox.com/download/security/security-bulletin/a72cd-4f7a54ce14460/cert_XRX14-003_V1.0.pdfhttps://exchange.xforce.ibmcloud.com/vulnerabilities/92548http://packetstormsecurity.com/files/126171/Xerox-DocuShare-SQL-Injection.htmlhttp://seclists.org/fulldisclosure/2014/Apr/205http://secunia.com/advisories/57996http://www.exploit-db.com/exploits/32886http://www.osvdb.org/105972http://www.securityfocus.com/bid/66922http://www.xerox.com/download/security/security-bulletin/a72cd-4f7a54ce14460/cert_XRX14-003_V1.0.pdfhttps://exchange.xforce.ibmcloud.com/vulnerabilities/92548
2014-05-02
Published