PT-2023-12175 · Nuxeo · Nuxeo Platform

Alvaro Muñoz + 1 · Publicado 2023-01-05 · Atualizado 2023-01-11 · CVE-2021-32828

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nuxeo Platform version 11.5.109

Description The Nuxeo Platform is an open source content management platform for building business applications. In the affected version, the oauth2 REST API is vulnerable to Reflected Cross-Site Scripting (XSS), which can be escalated to Remote Code Execution (RCE) by leveraging the automation API.

Recommendations For version 11.5.109, consider disabling the oauth2 REST API until a patch is available to prevent exploitation. Restrict access to the automation API to minimize the risk of Remote Code Execution (RCE).

Exploit

Correção

Deserialization of Untrusted Data

XSS

Enumeração de Fraquezas

CWE-502

CWE-79

Identificadores relacionados

CVE-2021-32828

GHSA-X347-FC9W-W7C3

Produtos afetados

Nuxeo Platform

Referências · 7

• 🔥 https://github.com/nuxeo/nuxeo/blob/master/modules/platform/nuxeo-platform-oauth/src/main/java/org/nuxeo/ecm/webengine/oauth2/OAuth2Callback.java · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2021-072-nuxeo · Exploit
• https://github.com/nuxeo/nuxeo · Nota
• https://osv.dev/vulnerability/GHSA-x347-fc9w-w7c3 · Aviso do Fabricante
• https://t.me/cibsecurity/56027 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2021-32828 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2021-32828 · Aviso do Fabricante