Cross Site Scripting (XSS) vulnerability exists in Alfresco Alfresco Community Edition v5.2.0 via the action parameter in the alfresco/s/admin/admin-nodebrowser API. Fixed in v6.2
References
Link | Resource |
---|---|
https://gist.github.com/paatui/a3c7ca8cf12594b437d3854f13d76cb8 | Exploit Third Party Advisory |
https://www.cvedetails.com/vulnerability-list/vendor_id-13372/product_id-27784/opxss-1/Alfresco-Alfresco.html | Third Party Advisory |
Configurations
History
11 Mar 2022, 14:42
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 6.1 |
CWE | CWE-79 | |
References | (MISC) https://www.cvedetails.com/vulnerability-list/vendor_id-13372/product_id-27784/opxss-1/Alfresco-Alfresco.html - Third Party Advisory | |
References | (MISC) https://gist.github.com/paatui/a3c7ca8cf12594b437d3854f13d76cb8 - Exploit, Third Party Advisory | |
CPE | cpe:2.3:a:alfresco:alfresco:5.2:*:*:*:community:*:*:* |
04 Mar 2022, 16:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-03-04 15:15
Updated : 2024-02-04 22:29
NVD link : CVE-2020-18327
Mitre link : CVE-2020-18327
CVE.ORG link : CVE-2020-18327
JSON object : View
Products Affected
alfresco
- alfresco
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')