Vulnerability Details : CVE-2014-9302
Potential exploit
Server-side request forgery (SSRF) vulnerability in the cmisbrowser servlet in Content Management Interoperability Service (CMIS) in Alfresco Community Edition 5.0.a and earlier allows remote attackers to trigger outbound requests via a crafted URI in the url parameter.
Vulnerability category: Server-side request forgery (SSRF)
Products affected by CVE-2014-9302
- cpe:2.3:a:alfresco:community_edition:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-9302
3.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 85 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-9302
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST |
References for CVE-2014-9302
-
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-0_Alfresco_Community_Edition_Multiple_SSRF_vulnerabilities_v10.txt
Exploit
-
http://seclists.org/bugtraq/2014/Jul/72
Bugtraq: SEC Consult SA-20140716-0 :: Multiple SSRF vulnerabilities in Alfresco Community EditionExploit
Jump to