CVE-2020-15181 - The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security dec

CVE-2020-15181

Summary

The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision. Intruders can get admin's access to the system using the vulnerability in the project. Impacts all servers where this add-on is installed. The problem is fixed in version 1.2.0

References

Vulnerable Configurations

cpe:2.3:a:alfresco:reset_password:-:*:*:*:*:alfresco:*:*
cpe:2.3:a:alfresco:reset_password:-:*:*:*:*:alfresco:*:*

CVSS

Base:	10.0 (as of 18-11-2021 - 17:51)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:L/Au:N/C:C/I:C/A:C

refmap via4

confirm	https://github.com/FlexSolution/AlfrescoResetPassword/security/advisories/GHSA-xrc8-fjp4-h4fv
misc	https://github.com/FlexSolution/AlfrescoResetPassword/commit/5927b9651356c4cd952cb9b485292583d305b47c

Last major update

18-11-2021 - 17:51

Published

18-09-2020 - 18:15

Last modified

18-11-2021 - 17:51