medium6.4Public exploit code
CVE-2014-9301
Server-side request forgery (SSRF) vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows remote attackers to trigger outbound re…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Alfresco - '/proxy?endpoint' Server-Side Request Forgery2014-07-16 · remote · multiple · Verified
Impact
Server-side request forgery (SSRF) vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows remote attackers to trigger outbound requests to intranet servers, conduct port scans, and read arbitrary files via a crafted URI in the endpoint parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Alfresco | Alfresco | through 4.2.f |
References
- NVD record
- CVE.org record
- http://seclists.org/bugtraq/2014/Jul/72
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-0_Alfresco_Community_Edition_Multiple_SSRF_vulnerabilities_v10.txt
- http://seclists.org/bugtraq/2014/Jul/72
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-0_Alfresco_Community_Edition_Multiple_SSRF_vulnerabilities_v10.txt