PT-2014-8927 · Alfresco · Alfresco Community Edition

V. Paulikas · Published 2014-12-07 · Updated 2014-12-09 · CVE-2014-9302

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Alfresco Community Edition versions 5.0.a and earlier

Description A server-side request forgery (SSRF) issue exists due to a vulnerability in the cmisbrowser servlet in Content Management Interoperability Service (CMIS). This allows remote attackers to trigger outbound requests via a crafted URI in the url parameter.

Recommendations For Alfresco Community Edition versions 5.0.a and earlier, consider restricting access to the cmisbrowser servlet as a temporary workaround until a patch is available. Avoid using the url parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2014-9302

Affected Products

Alfresco Community Edition

References · 4

• 🔥 http://seclists.org/bugtraq/2014/Jul/72 · Exploit
• 🔥 https://exploit-db.com/exploits/39259 · Exploit
• 🔥 https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-0_Alfresco_Community_Edition_Multiple_SSRF_vulnerabilities_v10.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9302 · Security Note