CVE-2023-49964 | BDVDB-2026-218941 Detail

Description#

An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE (Remote Code Execution). NOTE: this issue exists because of an incomplete fix for CVE-2020-12873.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://www.alfresco.com/products/community/download
https://github.com/mbadanoiu/CVE-2023-49964

Exploit#

No public exploit known

History#

Version 12023-12-11Record published in the CVE List.
Version 22024-08-02Most recent update recorded in the CVE List.