Cross-Site Request Forgery in Alfresco Community Edition by Alfresco
CVE-2014-9300

Currently unrated

Key Information:

Vendor

Alfresco

Status
Alfresco
Vendor
CVE Published:
7 December 2014

What is CVE-2014-9300?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the cmisbrowser servlet of Alfresco Community Edition prior to version 5.0.a. This flaw allows remote attackers to exploit the vulnerability by hijacking user authentication when requests are made to unauthorized URLs. Attackers can potentially obtain sensitive user credentials via the manipulation of URLs within the parameter, posing significant security risks for users of affected versions.

References

http://seclists.org/bugtraq/2014/Jul/72
mailing-listx_refsource_BUGTRAQ
https://www.sec-consult.com/fxdata/seccons/prod/temedia/a...
x_refsource_MISC

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.