How severe is CVE-2017-15044?

CVE-2017-15044 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2017-15044 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (79th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-15044?

CVE-2017-15044 affects Docuware Fulltext Server. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2017-15044?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2017-15044 published?

CVE-2017-15044 was published on 2017-11-21 and last updated on 2026-06-17.

CVE-2017-15044

CVE-2017-15044 is a high-severity vulnerability in Docuware Fulltext Server with a CVSS 3.x base score of 8.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 3.x base score 8.8)
CVSS v2: 6.5
EPSS exploit prediction: 2% (79th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Docuware Fulltext Server
Published: 2017-11-21
Last modified: 2026-06-17

Description

The default installation of DocuWare Fulltext Search server through 6.11 allows remote users to connect to and download searchable text from the embedded Solr service, bypassing DocuWare's access control features of the DocuWare user interfaces and API. An attacker can also gain privileges by modifying text. The default installation is unsafe because the server listens on the network interface, not the localhost interface.

Frequently asked questions

What is CVE-2017-15044?: The default installation of DocuWare Fulltext Search server through 6.11 allows remote users to connect to and download searchable text from the embedded Solr service, bypassing DocuWare's access control features of the DocuWare user interfaces and API. An attacker can also gain privileges by modifying text. The default installation is unsafe because the server listens on the network interface, not the localhost interface.
How severe is CVE-2017-15044?: CVE-2017-15044 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2017-15044 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (79th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-15044?: CVE-2017-15044 affects Docuware Fulltext Server. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2017-15044?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2017-15044 published?: CVE-2017-15044 was published on 2017-11-21 and last updated on 2026-06-17.

References

http://www.securityfocus.com/archive/1/541548

Affected products (1)

cpe:2.3:a:docuware:fulltext_server:*:*:*:*:*:*:*:*