Remote Access Vulnerability in Alfresco Community Edition Versions 6.0 and Lower
CVE-2019-14222

9.8CRITICAL

Key Information:

Vendor

Alfresco

Status
Alfresco
Vendor
CVE Published:
5 September 2019

What is CVE-2019-14222?

A security issue has been identified in Alfresco Community Edition versions 6.0 and lower, where an unauthenticated remote attacker can gain access to the Solr Web Admin Interface. This vulnerability arises from the use of a default private key found in all default installations. By extracting this private key, malicious actors can create a PKCS12 bundle, enabling them to gather sensitive information about the target system, including the operating system type, file locations, Java version, and Solr version. Furthermore, this access may facilitate subsequent attacks by exploiting the compromised administration interface.

References

https://github.com/DrunkenShells/Disclosures/tree/master/...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.