New Documentum Security Vulnerabilities Announced

On Monday, EMC announced it had identified and corrected two new security vulnerabilities in the Documentum family of products; both are of the Cross-Site Scripting variety.

The first involves eRoom 7.4.4 prior to P11.  Here is the announcement:  ESA-2013-073: EMC Documentum eRoom Multiple Cross Site Scripting Vulnerabilities.

The second vulnerability affects the 6.7 SP web client products.  Specifically:

• Documentum Webtop prior to 6.7 SP2 P07
• Documentum WDK prior to 6.7 SP2 P07
• Documentum Taskspace prior to 6.7 SP2 P07
• Documentum Records Manager prior to 6.7 SP2 P07
• Documentum Web Publisher prior to 6.5 SP7
• Documentum Digital Asset Manager prior to 6.5 SP6
• Documentum Administrator prior to 6.7 SP2 P07
• Documentum Capital Projects prior to 1.8 P01

Here is the announcement: ESA-2013-070: EMC Documentum Cross Site Scripting Vulnerability.

Please read the ESA’s for remedy details, but in most cases, applying the noted patches corrects the problems.