CVE-2014-3138

Name of the Vulnerable Software and Affected Versions Xerox DocuShare versions prior to 6.53 Patch 6 Hotfix 2 Xerox DocuShare versions 6.6.1 Update 1 prior to Hotfix 24 Xerox DocuShare versions 6.6.1 Update 2 prior to Hotfix 3

Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the PATH INFO to "/docushare/dsweb/ResultBackgroundJobMultiple/".

Recommendations For versions prior to 6.53 Patch 6 Hotfix 2, update to 6.53 Patch 6 Hotfix 2 or later. For versions 6.6.1 Update 1 prior to Hotfix 24, apply Hotfix 24 or later. For versions 6.6.1 Update 2 prior to Hotfix 3, apply Hotfix 3 or later.