cnvd - cnvd-2019-47024

cnvd-2019-47024

Vulnerability from cnvd

Title: Alfresco Software Alfresco Community Edition加密问题漏洞

Description:

Alfresco Software Alfresco Community Edition是美国Alfresco Software公司的一套开源的企业内容管理系统的社区版。该系统包括文档管理、办公协作等功能。

Alfresco Software Alfresco Community Edition 6.0及之前版本中存在加密问题漏洞，该漏洞源于在默认安装中，程序会带有默认的私钥。攻击者可借助该私钥利用该漏洞获取有关目标系统的信息。

Severity: 高

Formal description:

厂商尚未提供漏洞修复方案，请关注厂商主页更新： https://www.alfresco.com/ecm-software/alfresco-community-editions

Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14222 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14222-Default%20Certificate-Alfresco%20Community

Impacted products

Name
Alfresco Alfresco Community Edition <=6.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-14222",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2019-14222"
    }
  },
  "description": "Alfresco Software Alfresco Community Edition\u662f\u7f8e\u56fdAlfresco Software\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684\u4f01\u4e1a\u5185\u5bb9\u7ba1\u7406\u7cfb\u7edf\u7684\u793e\u533a\u7248\u3002\u8be5\u7cfb\u7edf\u5305\u62ec\u6587\u6863\u7ba1\u7406\u3001\u529e\u516c\u534f\u4f5c\u7b49\u529f\u80fd\u3002\n\nAlfresco Software Alfresco Community Edition 6.0\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u52a0\u5bc6\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5728\u9ed8\u8ba4\u5b89\u88c5\u4e2d\uff0c\u7a0b\u5e8f\u4f1a\u5e26\u6709\u9ed8\u8ba4\u7684\u79c1\u94a5\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9\u8be5\u79c1\u94a5\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u6709\u5173\u76ee\u6807\u7cfb\u7edf\u7684\u4fe1\u606f\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://www.alfresco.com/ecm-software/alfresco-community-editions",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-47024",
  "openTime": "2019-12-26",
  "products": {
    "product": "Alfresco Alfresco Community Edition \u003c=6.0"
  },
  "referenceLink": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14222\r\nhttps://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14222-Default%20Certificate-Alfresco%20Community",
  "serverity": "\u9ad8",
  "submitTime": "2019-09-06",
  "title": "Alfresco Software Alfresco Community Edition\u52a0\u5bc6\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2019-14222 (GCVE-0-2019-14222)

Vulnerability from cvelistv5

Published

2019-09-05 21:13

Modified

2024-08-05 00:12

Severity ?

CWE

Summary

An issue was discovered in Alfresco Community Edition versions 6.0 and lower. An unauthenticated, remote attacker could authenticate to Alfresco's Solr Web Admin Interface. The vulnerability is due to the presence of a default private key that is present in all default installations. An attacker could exploit this vulnerability by using the extracted private key and bundling it into a PKCS12. A successful exploit could allow the attacker to gain information about the target system (e.g., OS type, system file locations, Java version, Solr version, etc.) as well as the ability to launch further attacks by leveraging the access to Alfresco's Solr Web Admin Interface.

References

▼	URL	Tags
	https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14222-Default%20Certificate-Alfresco%20Community	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:12:42.890Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14222-Default%20Certificate-Alfresco%20Community"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Alfresco Community Edition versions 6.0 and lower. An unauthenticated, remote attacker could authenticate to Alfresco\u0027s Solr Web Admin Interface. The vulnerability is due to the presence of a default private key that is present in all default installations. An attacker could exploit this vulnerability by using the extracted private key and bundling it into a PKCS12. A successful exploit could allow the attacker to gain information about the target system (e.g., OS type, system file locations, Java version, Solr version, etc.) as well as the ability to launch further attacks by leveraging the access to Alfresco\u0027s Solr Web Admin Interface."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-09-05T21:13:08",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14222-Default%20Certificate-Alfresco%20Community"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-14222",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Alfresco Community Edition versions 6.0 and lower. An unauthenticated, remote attacker could authenticate to Alfresco\u0027s Solr Web Admin Interface. The vulnerability is due to the presence of a default private key that is present in all default installations. An attacker could exploit this vulnerability by using the extracted private key and bundling it into a PKCS12. A successful exploit could allow the attacker to gain information about the target system (e.g., OS type, system file locations, Java version, Solr version, etc.) as well as the ability to launch further attacks by leveraging the access to Alfresco\u0027s Solr Web Admin Interface."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14222-Default%20Certificate-Alfresco%20Community",
              "refsource": "MISC",
              "url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14222-Default%20Certificate-Alfresco%20Community"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-14222",
    "datePublished": "2019-09-05T21:13:08",
    "dateReserved": "2019-07-21T00:00:00",
    "dateUpdated": "2024-08-05T00:12:42.890Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted