Alfresco

Records21All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

Alfresco records in CISA KEV

No Alfresco vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Alfresco 13 records MEDIUM Alfresco Content Services 2 records MEDIUM Reset Password 2 records MEDIUM Alfresco Transform Services 1 record LOW Community Edition 1 record LOW Community Share 1 record LOW Share 1 record LOW

Records

2 records in Reset Password · all components

TI-2020-11953 CVE-2020-15181

Admin account takeover in Alfresco Reset Password

MEDIUM 45

The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01423 Published 2020-09-18 Fixed in 1.2.0 CWE-20

TI-2020-15741 CVE-2020-25728 · GHSA-xghg-58h4-gjjw

The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm (involving an…

MEDIUM 40

The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm (involving an increment) that allows a malicious user to change any user's account password include the admin account.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01001 Published 2020-09-17 No fix listed CWE-640

Open these records in search →

Critical	3
High	3
Medium	15
Low	0
No CVSS	0