Alfresco is a content management and collaboration platform deployed across enterprise document repositories and business-process workflows, where its relatively narrow product portfolio carries disproportionate exposure due to its internet-facing role and integration with sensitive data systems. Vulnerabilities affecting the vendor skew toward serious outcomes and frequently acquire public exploit code; the exposure recurs across its flagship Content Services product and related transform services through weakness classes including cross-site scripting, cross-site request forgery, deserialization flaws, and improper access control that are characteristic of web-facing content platforms. Defenders should prioritize patches for this vendor and restrict management and upload interfaces; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Alfresco over time
Signals from CVEs in this vendor scope (19 CVEs).
19 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-8777MEDIUM Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document. | Mar 2, 2020 | 5.4 | 31 | NO | YES |
CVE-2019-14223MEDIUM An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N. The Alfresco Share application is vulnerable to an Open Redirect attack via a crafted P | Sep 6, 2019 | 6.1 | 31 | NO | YES |
CVE-2020-8776MEDIUM Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file. | Mar 2, 2020 | 5.4 | 30 | NO | YES |
CVE-2019-14222CRITICAL An issue was discovered in Alfresco Community Edition versions 6.0 and lower. An unauthenticated, remote attacker could authenticate to Alfresco's Solr Web Admin Interface. The vul | Sep 5, 2019 | 9.8 | 30 | NO | NO |
CVE-2020-8778MEDIUM Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document, when the attacker has write access to a project. | Mar 2, 2020 | 5.4 | 29 | NO | YES |
CVE-2019-15566CRITICAL The Alfresco application before 1.8.7 for Android allows SQL injection in HistorySearchProvider.java. | Aug 26, 2019 | 9.8 | 28 | NO | NO |
CVE-2014-9302MEDIUM Server-side request forgery (SSRF) vulnerability in the cmisbrowser servlet in Content Management Interoperability Service (CMIS) in Alfresco Community Edition 5.0.a and earlier al | Dec 7, 2014 | 5.0 | 28 | NO | YES |
CVE-2021-41790HIGH An issue was discovered in Hyland org.alfresco:alfresco-content-services through 7.0.1.2. Script Action execution allows executing scripts uploaded outside of the Data Dictionary. | Oct 21, 2021 | 8.8 | 27 | NO | NO |
CVE-2014-9301MEDIUM Server-side request forgery (SSRF) vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows remote attackers to trigger outbound requests to intranet se | Dec 7, 2014 | 6.4 | 27 | NO | YES |
CVE-2020-25728HIGH The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm (involving an increment) that allows a malicious user to change any user's account password include the a | Sep 17, 2020 | 8.8 | 26 | NO | NO |
Signals from CVEs in this vendor scope (19 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Alfresco.
Media articles that mention a CVE ID that affects a product developed by Alfresco — matched by CVE ID, not by vendor name.