Reflected Cross Site Scripting (XSS) in Administration Console (CVE-2020-18327)

leochan168 — Mon, 27 Mar 2023 03:08:55 GMT

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.

Penetration tester found that Alfresco CMS version (v.5.2.0) affected by CVE-2020-18327 which may allow authenticated user (administrator) performed reflected XSS via the "action" parameter in the "alfresco/s/admin/admin-nodebrowser" API.

This vulnerability may allow attacker to inject malicious javascript on the victim web browser. This malicious javascript may able to perform various activities, such as:
1. Steal victim user session cookies.
2. Perform any action within the application that the user can perform.
3. View any information that the user is able to view.
4. Modify any information that the user is able to modify.
5. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.

Re: Reflected Cross Site Scripting (XSS) in Administration Console (CVE-2020-18327)

angelborroy — Mon, 27 Mar 2023 07:52:05 GMT

Since 5.2 is not supported any more, please upgrade to 6.2 version or later.

More details on the vulnerability available in https://gist.github.com/paatui/a3c7ca8cf12594b437d3854f13d76cb8

topic Re: Reflected Cross Site Scripting (XSS) in Administration Console (CVE-2020-18327) in Alfresco Forum

Reflected Cross Site Scripting (XSS) in Administration Console (CVE-2020-18327)

Re: Reflected Cross Site Scripting (XSS) in Administration Console (CVE-2020-18327)