CVE-2017-14525

Multiple open redirect vulnerabilities in OpenText Documentum Webtop 6.8.0160.0073 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a (1) URL in the startat parameter to xda/help/en/default.htm or (2) /%09/ (slash encoded horizontal tab slash) followed by a domain in the redirectUrl parameter to xda/component/virtuallinkconnect.

• CWE-601

• http://seclists.org/fulldisclosure/2017/Sep/57Issue Tracking, Mailing List, Third Party Advisory
• https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774Permissions Required, Vendor Advisory
• http://seclists.org/fulldisclosure/2017/Sep/57Issue Tracking, Mailing List, Third Party Advisory
• https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774Permissions Required, Vendor Advisory

Published

Sep 28, 2017

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1452IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.…
• CVE-2017-14520In Poppler 0.59.0, a floating point exception occurs in Spla…
• CVE-2017-14521In WonderCMS 2.3.1, the upload functionality accepts random …
• CVE-2017-14522In WonderCMS 2.3.1, the application's input fields accept ar…6.1
• CVE-2017-14523WonderCMS 2.3.1 is vulnerable to an HTTP Host header injecti…
• CVE-2017-14524Multiple open redirect vulnerabilities in OpenText Documentu…
• CVE-2017-14526Multiple XML external entity (XXE) vulnerabilities in the Op…
• CVE-2017-14527Multiple XML external entity (XXE) vulnerabilities in the Op…
• CVE-2017-14528The TIFFSetProfiles function in coders/tiff.c in ImageMagick…6.5
• CVE-2017-14529The pe_print_idata function in peXXigen.c in the Binary File…
• CVE-2017-1453IBM Security Access Manager Appliance 9.0.3 could allow a re…
• CVE-2017-14530WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7…8