PT-2021-9474 · Alfresco · Alfresco Enterprise Content Management

Alvaro Munoz + 1 · Published 2021-02-19 · Updated 2023-12-14 · CVE-2020-12873

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Alfresco Enterprise Content Management (ECM) versions prior to 6.2.1

Description An issue was discovered that allows a user with privileges to edit a FreeMarker template to execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running Alfresco.

Recommendations For versions prior to 6.2.1, update to version 6.2.1 or later to resolve the issue.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2020-12873

Affected Products

Alfresco Enterprise Content Management

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-12873 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12873 · Vendor Advisory
• https://issues.alfresco.com/jira/browse/MNT-21510 · Vendor Advisory
• https://securitylab.github.com/advisories/GHSL-2020-039-alfresco · Note
• https://t.me/cvenotify/63142 · Telegram Post
• https://t.me/cvenotify/63691 · Telegram Post
• https://t.me/cvenotify/10187 · Telegram Post