Vulnerability Database

309,776

Total vulnerabilities in the database

CVE-2021-32828

The Nuxeo Platform is an open source content management platform for building business applications. In version 11.5.109, the oauth2 REST API is vulnerable to Reflected Cross-Site Scripting (XSS). This XSS can be escalated to Remote Code Execution (RCE) by levering the automation API.

Published: Jan 5, 2023
Updated: Nov 16, 2025
CVE: CVE-2021-32828
GHSA: GHSA-x347-fc9w-w7c3
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.4
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWEs:

CWE-502
CWE-79

OWASP TOP 10:

A8 - Insecure Deserialization
A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
hyland / nuxeo	-	11.5.109.x
org.nuxeo.ecm.platform / nuxeo-platform-oauth	-	10.10.x

https://github.com/nuxeo/nuxeo/blob/master/modules/platform/nuxeo-platform-oauth/src/main/java/org/nuxeo/ecm/webengine/oauth2/OAuth2Callback.java
https://securitylab.github.com/advisories/GHSL-2021-072-nuxeo

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo