Multiple Cross-Site Scripting Vulnerabilities in Alfresco Enterprise by Alfresco
CVE-2014-2939

Currently unrated

Key Information:

Vendor

Alfresco

Status
Alfresco
Vendor
CVE Published:
2 June 2014

What is CVE-2014-2939?

Multiple cross-site scripting vulnerabilities exist in Alfresco Enterprise versions prior to 4.1.6.13. These vulnerabilities enable attackers to inject arbitrary web scripts or HTML into the application. Specific attack vectors include manipulation of XHTML documents, insertion through <% tags, and exploitation of parameters such as taskId in the share/page/task-edit interface. This could allow remote attackers to execute scripts in the context of a user session, potentially leading to unauthorized actions or exposure of sensitive information.

References

http://www.kb.cert.org/vuls/id/537684
third-party-advisoryx_refsource_CERT-VN

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.