CVE-2017-14759

Name of the Vulnerable Software and Affected Versions OpenText Document Sciences xPression versions prior to v4.5SP1 Patch 13

Description The issue is caused by an XML External Entity vulnerability. An unauthenticated user can exploit this to read directory listings or system files, or cause Server-Side Request Forgery (SSRF) or Denial of Service. The vulnerability is associated with the /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/ endpoint.

Recommendations For versions prior to v4.5SP1 Patch 13, update to v4.5SP1 Patch 13 or later to resolve the issue. As a temporary workaround, consider restricting access to the /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/ endpoint until a patch is applied.