Stored cross-site scripting in Alfresco Enterprise and Alfresco Community - CVE-2020-8777

Vulnerability details

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data when processing a user profile photo, as demonstrated by a SCRIPT element in an SVG document. A remote authenticated attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Affected software

How to mitigate CVE-2020-8777

Links to Public Exploits and PoC-codes

• Exploit #5749 - Alfresco 5.2.4 - Persistent Cross-Site Scripting (June 17, 2021)
• Exploit #2319 - CVE-repository ( :beetle: Repository of CVE found by OCD people) (April 7, 2020)

External References

• https://gitlab.com/snippets/1937042
• https://issues.alfresco.com/jira/browse/ALF-22110

Related Security Bulletins

• Multiple vulnerabilities in Alfresco Enterprise and Alfresco Community