An issue exists in Hyland org.alfresco:alfresco-content-services up to and including 6.2.2.18 and org.alfresco:alfresco-transform-services up to and including 1.3. A crafted HTML file, once uploaded, could trigger an unexpected request by the transformation engine. The response to the request is not available to the attacker, i.e., this is blind SSRF.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
alfresco alfresco content services |
||
alfresco alfresco transform services |