EMC Documentum eRoom before 7.4.4 does not properly validate session cookies, which…
Priority LOW 35CWE-264Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.
Summary
EMC Documentum eRoom before 7.4.4 does not properly validate session cookies, which allows remote attackers to hijack or replay sessions via unspecified vectors.
Why it matters now
EPSS 0.01201 68th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:emc:documentum_eroom:*:*:*:*:*:*:*:* | up to 7.4.3 | Vulnerable | EMC |
| cpe:2.3:a:emc:documentum_eroom:7.3.0:*:*:*:*:*:*:* | 7.3.0 | Vulnerable | EMC |
| cpe:2.3:a:emc:documentum_eroom:7.4.1:*:*:*:*:*:*:* | 7.4.1 | Vulnerable | EMC |
| cpe:2.3:a:emc:documentum_eroom:7.4.2:*:*:*:*:*:*:* | 7.4.2 | Vulnerable | EMC |
- cpe:2.3:a:emc:documentum_eroom:*:*:*:*:*:*:*:* Versions up to 7.4.3 Vulnerable ·EMC
- cpe:2.3:a:emc:documentum_eroom:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·EMC
- cpe:2.3:a:emc:documentum_eroom:7.4.1:*:*:*:*:*:*:* Versions 7.4.1 Vulnerable ·EMC
- cpe:2.3:a:emc:documentum_eroom:7.4.2:*:*:*:*:*:*:* Versions 7.4.2 Vulnerable ·EMC
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2012-0398
- 2026-10-03 Alias added: GHSA-8pr8-j4gw-89pw
References
More EMC Documentum Eroom vulnerabilities
- TI-2011-01520 Stack-based buffer overflow in ftserver.exe in the OpenText Hummingbird Client Connector… CVSS 2.0HIGH 10.0
- TI-2017-01995 Weak password recovery in EMC Documentum eRoom EMC Documentum eRoom version 7.4.4, EMC… CVSS 3.0CRITICAL 9.8
- TI-2011-02398 The file-blocking feature in EMC Documentum eRoom 7.3.x and 7.4.x before 7.4.3.g does not… CVSS 2.0HIGH 8.5
- TI-2013-02870 Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum eRoom before 7.4.4… CVSS 2.0MEDIUM 4.3
- TI-2012-00370 Cross-site scripting (XSS) vulnerability in EMC Documentum eRoom before 7.4.4 allows… CVSS 2.0MEDIUM 4.3
- TI-2014-02017 Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum eRoom 7.4.3, 7.4.4… CVSS 2.0LOW 3.5
Sources
- CVE-2012-0398 · CVE Program
- CVE-2012-0398 · NVD
- FIRST EPSS
- GHSA-8pr8-j4gw-89pw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences