« Volver al listado

CVE-2014-3138

Estado: ModificadaMedia (6.5)—

SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote authenticated users to execute arbitrary SQL commands via the PATH_INFO to /docushare/dsweb/ResultBackgroundJobMultiple/. NOTE: some of these details are obtained from third party information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Xerox — Docushare

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-3138",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-05-02T00:55:07.587",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/126171/Xerox-DocuShare-SQL-Injection.html",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2014/Apr/205",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/57996",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.exploit-db.com/exploits/32886",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/105972",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/66922",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.xerox.com/download/security/security-bulletin/a72cd-4f7a54ce14460/cert_XRX14-003_V1.0.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92548",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/126171/Xerox-DocuShare-SQL-Injection.html",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2014/Apr/205",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/57996",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/32886",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/105972",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/66922",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.xerox.com/download/security/security-bulletin/a72cd-4f7a54ce14460/cert_XRX14-003_V1.0.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92548",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote authenticated users to execute arbitrary SQL commands via the PATH_INFO to /docushare/dsweb/ResultBackgroundJobMultiple/.  NOTE: some of these details are obtained from third party information."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección SQL en DocuShare anterior a versión 6.53 Parche 6 Hotfix 2, versión 6.6.1 Update 1 y anterior a Hotfix 24, y versión 6.6.1 Update 2 y anteriores a Hotfix 3 de Xerox, permite a usuarios autenticados remotos ejecutar comandos SQL arbitrarios por medio del PATH_INFO en /docushare/dsweb/ResultBackgroundJobMultiple/. NOTA: algunos de estos datos se obtienen de la información de terceros."
    }
  ],
  "lastModified": "2026-06-17T00:07:39.530",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:xerox:docushare:6.5.3:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7EA39474-5CF8-46E0-8BD1-1AAD923C705F"
            },
            {
              "criteria": "cpe:2.3:a:xerox:docushare:6.5.3:patch6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79F24561-B977-4B88-A0A0-69BBD70AFA9F"
            },
            {
              "criteria": "cpe:2.3:a:xerox:docushare:6.6.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F0CC154E-6DEF-4459-AF02-C8B3A21416D2"
            },
            {
              "criteria": "cpe:2.3:a:xerox:docushare:6.6.1:update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67B405F4-986D-4585-BDC4-A9CD03B2BE91"
            },
            {
              "criteria": "cpe:2.3:a:xerox:docushare:6.6.1:update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "230B2172-24CF-4871-835A-9425452F4B1A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}