Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2017-15044: DocuWare Fulltext Search server can expose searchable text
CVE-2017-15044 · published 8 years ago
Summary
The DocuWare Fulltext Search server up to version 6.11 listens on the network and lets anyone reach the built‑in Solr search engine. This lets remote users download or change the text that is indexed, bypassing DocuWare’s normal login checks. Install the server on a local‑only interface or apply the vendor’s configuration guidance to restrict network access.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| docuware | fulltext_server |
<= 6.11 cpe:2.3:a:docuware:fulltext_server:*:*:*:*:*:*:*:* |
Original advisory text
The default installation of DocuWare Fulltext Search server through 6.11 allows remote users to connect to and download searchable text from the embedded Solr service, bypassing DocuWare's access c...
The default installation of DocuWare Fulltext Search server through 6.11 allows remote users to connect to and download searchable text from the embedded Solr service, bypassing DocuWare's access control features of the DocuWare user interfaces and API. An attacker can also gain privileges by modifying text. The default installation is unsafe because the server listens on the network interface, not the localhost interface.
References
- http://www.securityfocus.com/archive/1/541548 Third Party Advisory VDB Entry
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published21 Nov 2017
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-15044 · NVD
Track software like this
Free during beta