PT-2022-8593 · Alfresco · Alfresco Community Edition

Published 2022-03-04 · Updated 2024-03-06 · CVE-2020-18327

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Alfresco Community Edition versions 5.2.0 through 6.1

Description A Cross Site Scripting (XSS) issue exists via the action parameter in the "alfresco/s/admin/admin-nodebrowser" API endpoint. This allows for potential exploitation. The issue is fixed in version 6.2.

Recommendations For Alfresco Community Edition versions 5.2.0 through 6.1, update to version 6.2 to resolve the issue. As a temporary workaround, consider restricting access to the "alfresco/s/admin/admin-nodebrowser" API endpoint until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-ALFRESCO-2020-18327

CVE-2020-18327

Affected Products

Alfresco Community Edition

References · 7

• 🔥 https://gist.github.com/paatui/a3c7ca8cf12594b437d3854f13d76cb8 · Exploit
• https://osv.dev/vulnerability/CVE-2020-18327 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-18327 · Security Note
• https://osv.dev/vulnerability/BIT-alfresco-2020-18327 · Vendor Advisory
• https://t.me/cibsecurity/38422 · Telegram Post
• https://t.me/cvenotify/28105 · Telegram Post
• https://cvedetails.com/vulnerability-list/vendor_id-13372/product_id-27784/opxss-1/Alfresco-Alfresco.html · Note