medium5.0Public exploit code
CVE-2014-9302
Server-side request forgery (SSRF) vulnerability in the cmisbrowser servlet in Content Management Interoperability Service (CMIS) in Alfresco Community Edition…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Alfresco - '/cmisbrowser?url' Server-Side Request Forgery2014-07-16 · remote · multiple · Verified
Impact
Server-side request forgery (SSRF) vulnerability in the cmisbrowser servlet in Content Management Interoperability Service (CMIS) in Alfresco Community Edition 5.0.a and earlier allows remote attackers to trigger outbound requests via a crafted URI in the url parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Alfresco | Community Edition | through 5.0.a |
References
- NVD record
- CVE.org record
- http://seclists.org/bugtraq/2014/Jul/72
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-0_Alfresco_Community_Edition_Multiple_SSRF_vulnerabilities_v10.txt
- http://seclists.org/bugtraq/2014/Jul/72
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-0_Alfresco_Community_Edition_Multiple_SSRF_vulnerabilities_v10.txt