Security readout for executives and security teams
Plain-English summary
CVE-2018-7660 describes a reflected cross-site scripting issue in OpenText Documentum D2 Webtop v4.6.0030 build 059. If reachable, a malicious link could run browser script in a user’s session. Business impact depends on deployment exposure and the privileges of affected Documentum users.
Executive priority
Treat as a targeted enterprise application risk, not a confirmed emergency. Prioritize verification if Documentum supports sensitive document workflows or is internet-accessible.
Technical view
The report identifies reflected XSS in the servlet/Download endpoint through the _docbase or _username parameter. The provided sources do not include CVSS, CWE, vendor advisory, fixed version, or confirmed exploitation. Validate affected D2 Webtop versions and follow OpenText guidance for remediation.
Likely exposure
Exposure is likely limited to organizations running OpenText Documentum D2 Webtop v4.6.0030 build 059, especially where the web interface is reachable by users or external networks.
Exploitation context
The bundle does not show CISA KEV listing or confirmed active exploitation. The public reference describes reflected XSS, which typically requires a user to open crafted content or follow a malicious link.
Researcher notes
Evidence is thin: one public blog reference and CVE metadata. Avoid assuming broader affected versions, exploit maturity, or patch details without OpenText confirmation.
Mitigation direction
- Check OpenText support guidance for affected and fixed D2 Webtop versions.
- Prioritize upgrade or vendor-approved hotfix if this exact build is present.
- Restrict D2 Webtop access to trusted networks and authenticated users.
- Review web application controls for XSS filtering and secure output encoding.
- Monitor Documentum web logs for unusual servlet/Download parameter activity.
Validation and detection
- Inventory Documentum D2 Webtop instances and record exact build numbers.
- Confirm whether v4.6.0030 build 059 is deployed anywhere.
- Check if servlet/Download is reachable from untrusted networks.
- Review vendor advisories or support cases for a fixed version.
- Assess session sensitivity for users who access affected systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-7660 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://vipinxsec.blogspot.com/2018/04/reflected-xss-in-documentum-d2.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.