CVE-2017-14526: Opentext Documentum Administrator

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Administrator 7.2.0180.0055 allow remote authenticated users to list the contents of arbitrary directories, read arbitrary files, cause a denial of service, or, on Windows, obtain Documentum user hashes via a (1) crafted DTD, involving unspecified XML structures in a request to xda/com/documentum/ucf/server/transport/impl/GAIRConnector or crafted XML file in a MediaProfile file (2) import or (3) check in.

Affected products

• Opentext Documentum Administrator: version 7.2.0180.0055 only
• Opentext Documentum Webtop: version 6.8.0160.0073 only

Published 2017-09-28. Last modified 2026-06-17.