Cross Site Scripting Vulnerability in Alfresco Community Edition
CVE-2020-18327

6.1MEDIUM

Key Information:

Vendor

Alfresco

Status
Alfresco
Vendor
CVE Published:
4 March 2022

What is CVE-2020-18327?

A Cross Site Scripting (XSS) vulnerability has been identified in Alfresco Community Edition v5.2.0, allowing attackers to exploit the action parameter in the alfresco/s/admin/admin-nodebrowser API. If an attacker can inject malicious scripts into web pages viewed by other users, this could lead to unauthorized actions and access to sensitive information. The vulnerability has been addressed in version v6.2, highlighting the importance of regular updates to maintain security.

References

https://www.cvedetails.com/vulnerability-list/vendor_id-1...
x_refsource_MISC
https://gist.github.com/paatui/a3c7ca8cf12594b437d3854f13...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.