Siebene

**Name of the Vulnerable Software and Affected Versions** Alfresco Content Services version 23.3.0.7 **Description** An issue in Alfresco Content Services allows a remote attacker to execute arbitrary code via the Transfer Service. **Recommendations** For Alfresco Content Services version 23.3.0.7, consider disabling the Transfer Service as a temporary workaround until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Apache OFBiz versions prior to 18.12.10 **Description** The issue is related to a pre-authentication remote code execution vulnerability in Apache OFBiz due to the presence of unmaintained XML-RPC. This vulnerability allows an attacker to execute arbitrary code remotely. The estimated number of potentially affected devices worldwide is around 1,920, mainly distributed in the United States, China, and other countries. There have been reports of this issue being exploited in the wild, with attackers gaining full control over the server and potentially siphoning sensitive data. **Recommendations** For Apache OFBiz versions prior to 18.12.10, users are recommended to upgrade to version 18.12.10 to resolve the issue. As a temporary workaround, consider disabling the XML-RPC functionality until a patch is available. Restrict access to the vulnerable webtools/control/xmlrpc endpoint to minimize the risk of exploitation. Avoid using the vulnerable XML-RPC functionality in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Apache Jackrabbit versions 2.20.10 and earlier (stable branch) Apache Jackrabbit versions 2.21.17 and earlier (unstable branch) **Description** A Java object deserialization issue in Apache Jackrabbit webapp/standalone on all platforms allows an attacker to remotely execute code via RMI. The issue is related to the component "commons-beanutils", which contains a class that can be used for remote code execution over RMI. Users are advised to immediately update to versions 2.20.11 or 2.21.18. In general, RMI support can expose vulnerabilities by the mere presence of an exploitable class on the classpath. The native RMI protocol by default uses port 1099. RMI-over-HTTP in Jackrabbit by default uses the path "/rmi". To check whether RMI support is enabled, tools like "netstat" can be used to check the native RMI protocol, and an HTTP GET request can be used to check RMI-over-HTTP. **Recommendations** To resolve the issue for versions 2.20.10 and earlier (stable branch), update to version 2.20.11. To resolve the issue for versions 2.21.17 and earlier (unstable branch), update to version 2.21.18. As a temporary workaround, consider disabling RMI access altogether by removing the declaration and the mapping definition for the RemoteBindingServlet in the web.xml file and setting rmi.enabled=false in the bootstrap.properties file.

**Name of the Vulnerable Software and Affected Versions** Openfire versions 3.10.0 through 4.6.7 Openfire versions 4.7.0 through 4.7.4 **Description** The vulnerability is related to a path traversal attack in the administrative console of Openfire, allowing an unauthenticated user to access restricted pages. This issue affects all versions of Openfire released since April 2015. The estimated number of potentially affected devices worldwide is significant, with over 3,000 Openfire servers reportedly at risk. There have been real-world incidents where this issue was exploited, including the deployment of Kinsing malware and cryptominers. Technical details about exploitation include the use of path traversal to access restricted pages in the Openfire Admin Console. **Recommendations** For Openfire versions 3.10.0 through 4.6.7, upgrade to version 4.6.8 or later. For Openfire versions 4.7.0 through 4.7.4, upgrade to version 4.7.5 or later. As a temporary workaround, consider restricting access to the setup environment to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** net.sourceforge.htmlunit:htmlunit versions 0 through 3.0.0 **Description** The issue is related to incorrect code generation management in the HtmlUnit browser, which can be exploited to execute arbitrary code remotely via XSTL when browsing an attacker's webpage. This can allow a remote attacker to execute arbitrary code. **Recommendations** For versions 0 through 3.0.0, update to a version later than 3.0.0 to resolve the issue. As a temporary workaround, consider restricting access to web pages that may exploit this vulnerability until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Concrete versions 8.5.7 and below Concrete versions 9.0 through 9.0.2 **Description** The issue allows traversal in `/index.php/ccm/system/file/upload` which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing `/index.php/ccm/system/file/upload` to ensure Concrete doesn’t allow traversal and by changing `isFullChunkFilePresent` to have an early false return when input doesn't match expectations. **Recommendations** For Concrete versions 8.5.7 and below, update to a version above 8.5.7 to resolve the issue. For Concrete versions 9.0 through 9.0.2, update to a version above 9.0.2 to resolve the issue. As a temporary workaround, consider restricting access to the `/index.php/ccm/system/file/upload` endpoint until a patch is available. Restrict input to the `isFullChunkFilePresent` function to minimize the risk of exploitation.