CVE-2021-32828

Опубликовано: 05 янв. 2023

Источник: nvd

CVSS3: 5.4

CVSS3: 6.1

EPSS Низкий

Описание

The Nuxeo Platform is an open source content management platform for building business applications. In version 11.5.109, the oauth2 REST API is vulnerable to Reflected Cross-Site Scripting (XSS). This XSS can be escalated to Remote Code Execution (RCE) by levering the automation API.

Ссылки

https://github.com/nuxeo/nuxeo/blob/master/modules/platform/nuxeo-platform-oauth/src/main/java/org/nuxeo/ecm/webengine/oauth2/OAuth2Callback.java
Exploit
Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2021-072-nuxeo
Exploit
Third Party Advisory
https://github.com/nuxeo/nuxeo/blob/master/modules/platform/nuxeo-platform-oauth/src/main/java/org/nuxeo/ecm/webengine/oauth2/OAuth2Callback.java
Exploit
Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2021-072-nuxeo
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:hyland:nuxeo:*:*:*:*:*:*:*:*

Версия до 11.5.109 (включая)

EPSS

Процентиль: 54%

0.00318

Низкий

5.4 Medium

CVSS3

6.1 Medium

CVSS3

Дефекты

CWE-502

CWE-79

Связанные уязвимости

GHSA-x347-fc9w-w7c3

CVSS3: 5.4

github

около 3 лет назад

Nuxeo vulnerable to Reflected Cross-Site Scripting leading to Remote Code Execution

EPSS

Процентиль: 54%

0.00318

Низкий

5.4 Medium

CVSS3

6.1 Medium

CVSS3

Дефекты

CWE-502

CWE-79