« Volver al listado

CVE-2017-5586

Estado: ModificadaCrítica (9.8)—

OpenText Documentum D2 (formerly EMC Documentum D2) 4.x allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the BeanShell (bsh) and Apache Commons Collections (ACC) libraries.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Opentext — Documentum D2

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-5586",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-02-22T16:59:00.567",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/141105/OpenText-Documentum-D2-4.x-Remote-Code-Execution.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/96216",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/41366/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/141105/OpenText-Documentum-D2-4.x-Remote-Code-Execution.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/96216",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/41366/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenText Documentum D2 (formerly EMC Documentum D2) 4.x allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the BeanShell (bsh) and Apache Commons Collections (ACC) libraries."
    },
    {
      "lang": "es",
      "value": "OpenText Documentum D2 (anteriormente EMC Documentum D2) 4.x permite a atacantes remotos ejecutar comandos arbitrarios a través de un objeto Java serializado manipulado, relacionado con las librerías BeanShell (bsh) y Apache Commons Collections (ACC)."
    }
  ],
  "lastModified": "2026-06-17T01:20:47.473",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opentext:documentum_d2:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4667B360-FF26-4F2B-86EA-106ACA727B28"
            },
            {
              "criteria": "cpe:2.3:a:opentext:documentum_d2:4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "908D9F8A-87D7-46A0-BA8E-B7CA4A7808F9"
            },
            {
              "criteria": "cpe:2.3:a:opentext:documentum_d2:4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5A08F926-B628-45B2-A745-758F7E5E3217"
            },
            {
              "criteria": "cpe:2.3:a:opentext:documentum_d2:4.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7ED28126-775B-4DFD-92B1-38E70CABCF63"
            },
            {
              "criteria": "cpe:2.3:a:opentext:documentum_d2:4.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EAB00B8A-6E66-4E6D-9182-B3BC94B47E44"
            },
            {
              "criteria": "cpe:2.3:a:opentext:documentum_d2:4.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E8E54DC3-7B37-43EF-B355-9CD4AF1F778D"
            },
            {
              "criteria": "cpe:2.3:a:opentext:documentum_d2:4.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89FDA5A9-1028-47BE-9190-0B7095C6441C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}