Is there a patch available for CVE-2025-3271?

Yes, a patch is available for CVE-2025-3271. Update the affected software to the latest version immediately.

Documentum Webtop CVE-2025-3271

Q: What is the CVSS score of CVE-2025-3271?

CVE-2025-3271 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2025-210878 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-09-09 OpenText

GHSA-759m-vph2-jm2g

XSS Documentum Webtop Opentext

4.8

CVSS 4.0 · Vendor: OpenText

Severity by source

Vendor (OpenText) PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Authenticated attacker (PR:L) injects script requiring victim interaction (UI:R); scope change (S:C) and limited C/I impact are standard for stored/reflected XSS.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (OpenText).

CVSS VectorVendor: OpenText

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Sep 09, 2026 - 10:19 EUVD

Analysis Generated

Sep 09, 2026 - 10:06 vuln.today

DescriptionCVE.org

Documentum Webtop versions prior to 16.7.1 software is vulnerable to an XSS

AnalysisAI

Cross-site scripting in OpenText Documentum Webtop versions prior to 16.7.1 allows an authenticated attacker to inject malicious scripts into the application that execute in a victim user's browser upon interaction with attacker-controlled content. The CVSS 4.0 vector (PR:L/UI:A) confirms exploitation requires both a valid account and active victim engagement, constraining the realistic attack surface to insider threats or compromised accounts. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Documentum Webtop is OpenText's browser-based interface for the EMC Documentum enterprise content management (ECM) platform, used by large organizations to manage documents and digital assets. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), the canonical XSS root cause, where user-supplied input is not sufficiently sanitized or encoded before being reflected or stored and rendered in HTML context. The affected CPE (cpe:2.3:a:opentext™:documentum_webtop:*:*:*:*:*:*:*:*) covers all versions up to the 16.7.1 fix boundary. The CVSS 4.0 VC:L/VI:L scoring indicates limited per-session impact - consistent with client-side script execution enabling session token theft or unauthorized DOM manipulation within the victim's browser context, without direct server-side compromise.

RemediationAI

Upgrade to Documentum Webtop version 16.7.1 or later, which resolves the XSS vulnerability per the vendor advisory KB0869472 available at https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0869472. If immediate patching is not feasible, compensating controls should include enforcing strict Content-Security-Policy (CSP) headers on the Webtop deployment to limit script execution to trusted origins - note this may break legitimate Webtop UI functionality and requires testing. Additionally, restricting write access to content fields to the minimum necessary set of users reduces the population of potential attackers. Input review workflows or approval gates for user-submitted content can also limit attacker-controlled content from reaching other users' sessions.