Vulnerability · Published Jan 18, 2025 · Assigned by VulDB
CVE-2025-0557Hyland Alfresco Community Edition URL s cross site scripting
Medium 4.3
In plain English
A medium-severity cross-site scripting in Alfresco Community Edition from Hyland. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Official description
A vulnerability classified as problematic has been found in Hyland Alfresco Community Edition and Alfresco Enterprise Edition up to 6.2.2. This affects an unknown part of the file /share/s/ of the component URL Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0 is able to address this issue. It is recommended to upgrade the affected component.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hyland | Alfresco Community Edition | 6.2.06.2.16.2.2 |
| Hyland | Alfresco Enterprise Edition | 6.2.06.2.16.2.2 |
Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- VDB-292491 | Hyland Alfresco Community Edition URL s cross site scripting vdb-entry
- VDB-292491 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #474306 | Alfresco Software Alfresco Community/Enterprise 5.2.0 to 6.2.2 Cross-Site Scripting third-party-advisory