5.4

CVE-2021-41791

An issue was discovered in Hyland org.alfresco:share through 7.0.0.2 and org.alfresco:community-share through 7.0. An evasion of the XSS filter for HTML input validation in the Alfresco Share User Interface leads to stored XSS that could be exploited by an attacker (given that he has privileges on the content collaboration features).

Data is provided by the National Vulnerability Database (NVD)
Alfresco ≫ Community Share Version <= 7.0
Alfresco ≫ Share Version >= 5.0.0.0 <= 5.2.7.11
Alfresco ≫ Share Version >= 6.0.1.0 <= 6.0.1.2
Alfresco ≫ Share Version >= 6.0.2.0 <= 6.2.2.4
Alfresco ≫ Share Version >= 6.1.1.0 <= 6.1.1.2
Alfresco ≫ Share Version7.0
Alfresco ≫ Share Version7.0.0.1
Alfresco ≫ Share Version7.0.0.2
Alfresco ≫ Share Version7.0.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.21% 0.433
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.