The file-blocking feature in EMC Documentum eRoom 7.3.x and 7.4.x before 7.4.3.g does not…
Priority MEDIUM 42CWE-264Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.
Summary
The file-blocking feature in EMC Documentum eRoom 7.3.x and 7.4.x before 7.4.3.g does not properly restrict the uploading and opening of files with dangerous file types, which allows remote authenticated users to execute arbitrary code via an uploaded file.
Why it matters now
EPSS 0.02685 85th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:emc:documentum_eroom:7.3.0:*:*:*:*:*:*:* | 7.3.0 | Vulnerable | EMC |
| cpe:2.3:a:emc:documentum_eroom:7.4.1:*:*:*:*:*:*:* | 7.4.1 | Vulnerable | EMC |
| cpe:2.3:a:emc:documentum_eroom:7.4.2:*:*:*:*:*:*:* | 7.4.2 | Vulnerable | EMC |
| cpe:2.3:a:emc:documentum_eroom:7.4.3:*:*:*:*:*:*:* | 7.4.3 | Vulnerable | EMC |
- cpe:2.3:a:emc:documentum_eroom:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·EMC
- cpe:2.3:a:emc:documentum_eroom:7.4.1:*:*:*:*:*:*:* Versions 7.4.1 Vulnerable ·EMC
- cpe:2.3:a:emc:documentum_eroom:7.4.2:*:*:*:*:*:*:* Versions 7.4.2 Vulnerable ·EMC
- cpe:2.3:a:emc:documentum_eroom:7.4.3:*:*:*:*:*:*:* Versions 7.4.3 Vulnerable ·EMC
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2011-2739
- 2026-10-03 Alias added: GHSA-93mp-77gf-xggq
References
Advisory 1
More EMC Documentum Eroom vulnerabilities
- TI-2011-01520 Stack-based buffer overflow in ftserver.exe in the OpenText Hummingbird Client Connector… CVSS 2.0HIGH 10.0
- TI-2017-01995 Weak password recovery in EMC Documentum eRoom EMC Documentum eRoom version 7.4.4, EMC… CVSS 3.0CRITICAL 9.8
- TI-2012-00364 EMC Documentum eRoom before 7.4.4 does not properly validate session cookies, which… CVSS 2.0HIGH 7.5
- TI-2013-02870 Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum eRoom before 7.4.4… CVSS 2.0MEDIUM 4.3
- TI-2012-00370 Cross-site scripting (XSS) vulnerability in EMC Documentum eRoom before 7.4.4 allows… CVSS 2.0MEDIUM 4.3
- TI-2014-02017 Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum eRoom 7.4.3, 7.4.4… CVSS 2.0LOW 3.5
Sources
- CVE-2011-2739 · CVE Program
- CVE-2011-2739 · NVD
- FIRST EPSS
- GHSA-93mp-77gf-xggq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences