PT-2019-13542 · Alfresco+1 · Alfresco Community Edition+1

Drunkenshells · Publicado 2019-09-05 · Atualizado 2021-07-21 · CVE-2019-14222

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alfresco Community Edition versions 6.0 and lower

Description An issue allows an unauthenticated, remote attacker to authenticate to Alfresco's Solr Web Admin Interface. This is due to a default private key present in all default installations. An attacker could exploit this by using the extracted private key and bundling it into a PKCS12, potentially gaining information about the target system, such as OS type, system file locations, Java version, and Solr version. This access could also be leveraged to launch further attacks.

Recommendations For Alfresco Community Edition versions 6.0 and lower, consider removing or replacing the default private key to prevent unauthorized access to Alfresco's Solr Web Admin Interface. As a temporary workaround, restrict access to the Solr Web Admin Interface until a more permanent solution can be implemented.

Exploit

Correção

Enumeração de Fraquezas

CWE-1188

Identificadores relacionados

CVE-2019-14222

Produtos afetados

Alfresco Community Edition

Solr

Referências · 3

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14222-Default%20Certificate-Alfresco%20Community · Exploit
• https://osv.dev/vulnerability/CVE-2019-14222 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-14222 · Nota de Segurança