CVE-2023-49964

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-49964
An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE (Remote Code Execution). NOTE: this issue exists because of an incomplete fix for CVE-2020-12873.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/mbadanoiu/CVE-2023-49964 Third Party Advisory
https://www.alfresco.com/products/community/download Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:hyland:alfresco_content_services:*:*:*:*:community:*:*:*
History

14 Dec 2023, 14:36

Type Values Removed Values Added
References () https://github.com/mbadanoiu/CVE-2023-49964 - () https://github.com/mbadanoiu/CVE-2023-49964 - Third Party Advisory
References () https://www.alfresco.com/products/community/download - () https://www.alfresco.com/products/community/download - Product
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
CPE cpe:2.3:a:hyland:alfresco_content_services:*:*:*:*:community:*:*:*
CWE CWE-74
First Time Hyland alfresco Content Services
Hyland

11 Dec 2023, 12:20

Type Values Removed Values Added
Summary
  • (es) Se descubrió un problema en Hyland Alfresco Community Edition hasta 7.2.0. Al insertar contenido malicioso en el archivo folder.get.html.ftl, un atacante puede realizar ataques SSTI (inyección de plantilla del lado del servidor), que pueden aprovechar los objetos expuestos de FreeMarker para evitar las restricciones y lograr RCE (ejecución remota de código). NOTA: este problema existe debido a una solución incompleta para CVE-2020-12873.

11 Dec 2023, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-11 08:15

Updated : 2023-12-14 14:36

NVD link : CVE-2023-49964

Mitre link : CVE-2023-49964

CVE.ORG link : CVE-2023-49964

JSON object : View

Products Affected

hyland

  • alfresco_content_services
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')