CVE-2023-49964: High severity alfresco enterprise content management vulnerability
An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE (Remote Code Execution). NOTE: this issue exists because of an incomplete fix for CVE-2020-12873.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-49964?
CVE-2023-49964 is classified as a high severity vulnerability due to its potential for server-side template injection and remote code execution.
How do I fix CVE-2023-49964?
To mitigate CVE-2023-49964, users should update to the latest version of Hyland Alfresco Content Services that addresses this vulnerability.
What types of attacks can CVE-2023-49964 enable?
CVE-2023-49964 can enable attacker-controlled server-side template injection attacks, potentially leading to remote code execution.
Which versions of Hyland Alfresco Content Services are affected by CVE-2023-49964?
CVE-2023-49964 affects all versions of Hyland Alfresco Content Services up to and including 7.2.0.
Who is vulnerable to CVE-2023-49964?
Organizations using Hyland Alfresco Community Edition version 7.2.0 or earlier are vulnerable to CVE-2023-49964.