A vulnerability was found in Alfresco Community Edition 5.2 201707. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Solr Configuration File Handler. The manipulation as part of a Configuration File leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in Alfresco Community Edition 5.2 201707. By leveraging multiple components in the Alfresco Software applications, an exploit chain was observed that allows an attacker to achieve remote code execution on the victim machine. The attacker must upload malicious Solr configuration files and then receive a JMX connection from the victim, and serve a Java object that results in deserialization and code execution.

The weakness was shared 09/05/2019. This vulnerability is known as CVE-2019-14224 since 07/21/2019. The attack can be launched remotely. The successful exploitation needs a single authentication. Neither technical details nor an exploit are publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry 141288 is related to this item.

Productinfo

Vendor

• Alfresco

Name

• Community Edition

Version

• 5.2 201707

Support

• end of life (old version)

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion