CVE-2023-49964

An issue was discovered in Hyland Alfresco Community Edition through 7.2.0

published December 11, 2023

CVSS

—

EPSS

35%

Percentile

98.4

In the wild

Unconfirmed

What it is

An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE (Remote Code Execution). NOTE: this issue exists because of an incomplete fix for CVE-2020-12873.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.34684 · 98.4th percentile
Published: 2023-12-11T00:00Z

EPSS history

Timeline

11 DEC 00:00Z
An issue was discovered in Hyland Alfresco Community Edition through 7.2.0
cvelistv5