BIT-alfresco-2020-8777

vendorUSosv

view advisory published 2024-03-06Licence: per source

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-8777US	medium5.4	3.17% (88th)	Exploit	2020-03-02
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document.

references

External citations — patches, advisories, analysis.

http://packetstormsecurity.com/files/156599/Alfresco-5.2.4-Cross-Site-Scripting.htmlWEB
https://gitlab.com/snippets/1937042WEB
https://issues.alfresco.com/jira/browse/ALF-22110WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan