Server-Side Request Forgery Vulnerability in Alfresco Community Edition
CVE-2014-9302

Currently unrated

Key Information:

Vendor

Alfresco

Status
Community Edition
Vendor
CVE Published:
7 December 2014

What is CVE-2014-9302?

This vulnerability exists within the cmisbrowser servlet of the Content Management Interoperability Service (CMIS) in Alfresco Community Edition 5.0.a and earlier versions. It allows remote attackers to manipulate the outbound requests sent by the server by injecting crafted URIs into the URL parameter. This can lead to unauthorized access to internal systems or data, making it critical to apply necessary mitigations.

References

http://seclists.org/bugtraq/2014/Jul/72
mailing-listx_refsource_BUGTRAQ
https://www.sec-consult.com/fxdata/seccons/prod/temedia/a...
x_refsource_MISC

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.