CVE-2013-6176

Multiple SQL injection vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote authenticated users to execute arbitrary SQL commands via unspecified input to a (1) xAdmin or (2) xDashboard form.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:P/I:P/A:P
dellCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 50%
VendorProductVersion
emcdocument_sciences_xpression
4.1:sp1
emcdocument_sciences_xpression
4.2
emcdocument_sciences_xpression
4.5
emcdocument_sciences_xpression
4.1:sp1
emcdocument_sciences_xpression
4.2
emcdocument_sciences_xpression
4.5
emcdocument_sciences_xpression
4.1:sp1
emcdocument_sciences_xpression
4.2
emcdocument_sciences_xpression
4.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://archives.neohapsis.com/archives/bugtraq/2013-11/0095.html
http://packetstormsecurity.com/files/124070/EMC-Document-Sciences-xPression-XSS-CSRF-Redirect-SQL-Injection.html
http://www.kb.cert.org/vuls/id/346982
http://www.securitytracker.com/id/1029384
http://archives.neohapsis.com/archives/bugtraq/2013-11/0095.html
http://packetstormsecurity.com/files/124070/EMC-Document-Sciences-xPression-XSS-CSRF-Redirect-SQL-Injection.html
http://www.kb.cert.org/vuls/id/346982
http://www.securitytracker.com/id/1029384