Pablo Gaston Milano has reported a vulnerability in Documentum Administrator and Documentum Webtop, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to an error within the "dmclTrace.jsp" script when writing to files. This can be exploited to e.g. place a malicious script on the web server by writing malicious content to an arbitrary file.

The vulnerability is reported in Documentum Administrator 5.3.0.313 and Documentum Webtop 5.3.0.317. Other versions may also be affected.

Solution
The vendor has reportedly fixed the vulnerability in SP4 and later.

Provided and/or discovered by
Pablo Gaston Milano, CYBSEC S.A.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.cybsec.com/vuln/CYBSEC-Security_Advisory_Documentum_dmclTrace_Arbitrary_file_overwrite.pdf

Deep Links
Links available to Secunia VIM customers