Weak password recovery in EMC Documentum eRoom EMC Documentum eRoom version 7.4.4, EMC…
Priority MEDIUM 45CWE-640Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-640.
Summary
EMC Documentum eRoom version 7.4.4, EMC Documentum eRoom version 7.4.4 SP1, EMC Documentum eRoom version prior to 7.4.5 P04, EMC Documentum eRoom version prior to 7.5.0 P01 includes an unverified password change vulnerability that could potentially be exploited by malicious users to compromise the affected system.
Why it matters now
EPSS 0.01633 76th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | EMC Documentum eRoom EMC Documentum eRoom version 7.4.4, EMC Documentum eRoom version 7.4.4 SP1, EMC Documentum eRoom version prior to 7.4.5 P04, EMC Documentum eRoom version prior to 7.5.0 P01 | EMC Documentum eRoom EMC Documentum eRoom version 7.4.4, EMC Documentum eRoom version 7.4.4 SP1, EMC Documentum eRoom version prior to 7.4.5 P04, EMC Documentum eRoom version prior to 7.5.0 P01 | — | No fix listed | CNA |
- EMC Documentum eRoom EMC Documentum eRoom version 7.4.4, EMC Documentum eRoom version 7.4.4 SP1, EMC Documentum eRoom version prior to 7.4.5 P04, EMC Documentum eRoom version prior to 7.5.0 P01 Vendor— Affected EMC Documentum eRoom EMC Documentum eRoom version 7.4.4, EMC Documentum eRoom version 7.4.4 SP1, EMC Documentum eRoom version prior to 7.4.5 P04, EMC Documentum eRoom version prior to 7.5.0 P01 Fixed in — No fix listed CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:emc:documentum_eroom:7.4.4:*:*:*:*:*:*:* | 7.4.4 | Vulnerable | EMC |
| cpe:2.3:a:emc:documentum_eroom:7.4.4:sp1:*:*:*:*:*:* | 7.4.4 sp1 | Vulnerable | EMC |
| cpe:2.3:a:emc:documentum_eroom:7.4.5:*:*:*:*:*:*:* | 7.4.5 | Vulnerable | EMC |
| cpe:2.3:a:emc:documentum_eroom:7.4.5:p01:*:*:*:*:*:* | 7.4.5 p01 | Vulnerable | EMC |
| cpe:2.3:a:emc:documentum_eroom:7.4.5:p02:*:*:*:*:*:* | 7.4.5 p02 | Vulnerable | EMC |
| cpe:2.3:a:emc:documentum_eroom:7.4.5:p03:*:*:*:*:*:* | 7.4.5 p03 | Vulnerable | EMC |
| cpe:2.3:a:emc:documentum_eroom:7.5.0:*:*:*:*:*:*:* | 7.5.0 | Vulnerable | EMC |
- cpe:2.3:a:emc:documentum_eroom:7.4.4:*:*:*:*:*:*:* Versions 7.4.4 Vulnerable ·EMC
- cpe:2.3:a:emc:documentum_eroom:7.4.4:sp1:*:*:*:*:*:* Versions 7.4.4 sp1 Vulnerable ·EMC
- cpe:2.3:a:emc:documentum_eroom:7.4.5:*:*:*:*:*:*:* Versions 7.4.5 Vulnerable ·EMC
- cpe:2.3:a:emc:documentum_eroom:7.4.5:p01:*:*:*:*:*:* Versions 7.4.5 p01 Vulnerable ·EMC
- cpe:2.3:a:emc:documentum_eroom:7.4.5:p02:*:*:*:*:*:* Versions 7.4.5 p02 Vulnerable ·EMC
- cpe:2.3:a:emc:documentum_eroom:7.4.5:p03:*:*:*:*:*:* Versions 7.4.5 p03 Vulnerable ·EMC
- cpe:2.3:a:emc:documentum_eroom:7.5.0:*:*:*:*:*:*:* Versions 7.5.0 Vulnerable ·EMC
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-2766
- 2026-10-03 Alias added: GHSA-fgmj-4xc2-m385
References
—
More EMC Documentum Eroom vulnerabilities
- TI-2011-01520 Stack-based buffer overflow in ftserver.exe in the OpenText Hummingbird Client Connector… CVSS 2.0HIGH 10.0
- TI-2011-02398 The file-blocking feature in EMC Documentum eRoom 7.3.x and 7.4.x before 7.4.3.g does not… CVSS 2.0HIGH 8.5
- TI-2012-00364 EMC Documentum eRoom before 7.4.4 does not properly validate session cookies, which… CVSS 2.0HIGH 7.5
- TI-2013-02870 Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum eRoom before 7.4.4… CVSS 2.0MEDIUM 4.3
- TI-2012-00370 Cross-site scripting (XSS) vulnerability in EMC Documentum eRoom before 7.4.4 allows… CVSS 2.0MEDIUM 4.3
- TI-2014-02017 Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum eRoom 7.4.3, 7.4.4… CVSS 2.0LOW 3.5
Sources
- CVE-2017-2766 · CVE Program
- CVE-2017-2766 · NVD
- FIRST EPSS
- GHSA-fgmj-4xc2-m385 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences