CVE-2021-32828

The Nuxeo Platform is an open source content management platform for building business applications. In version 11.5.109, the oauth2 REST API is vulnerable to Reflected Cross-Site Scripting (XSS). This XSS can be escalated to Remote Code Execution (RCE) by levering the automation API.

Published: Jan 6, 2023
Updated: May 9, 2024
CVE: CVE-2021-32828
GHSA: GHSA-x347-fc9w-w7c3
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 6.1
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWEs:

CWE-79
CWE-502

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)
A8 - Insecure Deserialization

Affected Software
References

Software	From	Fixed in
hyland / nuxeo	-	11.5.109.x
org.nuxeo.ecm.platform / nuxeo-platform-oauth	-	10.10.x

https://github.com/nuxeo/nuxeo/blob/master/modules/platform/nuxeo-platform-oauth/src/main/java/org/nuxeo/ecm/webengine/oauth2/OAuth2Callback.java
https://securitylab.github.com/advisories/GHSL-2021-072-nuxeo

Vulnerability Database

291,049

CVE-2021-32828