Hyland Alfresco Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Hyland Alfresco Community Edition and Alfresco Enterprise Edition versions through 6.2.2. The issue resides in the URL Handler component, specifically within the /share/s/ endpoint. This vulnerability allows remote attackers to inject malicious scripts that are executed in the context of the victim's browser, potentially compromising data integrity and confidentiality.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute arbitrary scripts in the context of the user's browser.

Reproduction

The vulnerability can be reproduced by injecting a script payload into an unsanitized parameter of the /share/s/ endpoint. When the crafted URL is accessed, the injected JavaScript executes in the browser of the user, demonstrating the cross-site scripting flaw.

Remediation

Users are advised to upgrade to Alfresco Community Edition or Alfresco Enterprise Edition version 7.0 or later.