high8.8
CVE-2021-41790
An issue was discovered in Hyland org.alfresco:alfresco-content-services through 7.0.1.2.
Impact
An issue was discovered in Hyland org.alfresco:alfresco-content-services through 7.0.1.2. Script Action execution allows executing scripts uploaded outside of the Data Dictionary. This could allow a logged-in attacker to execute arbitrary code inside a sandboxed environment.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Alfresco | Alfresco Content Services | from 5.0.0.0 through 5.2.7.11 from 6.0.0.0 through 6.0.1.9 from 6.1.0.0 through 6.1.1.10 from 6.2.0.0 through 6.2.2.18 from 7.0.1.0 through 7.0.1.2 Version 7.0 |