En resumen
- CVE-2021-32828 es una vulnerabilidad MEDIO (CVSS 6.1) que afecta a org.nuxeo.ecm.platform:nuxeo-platform-oauth, nuxeo (hyland).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.74%, mayor que el 54.6% de las vulnerabilidades.
- Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.
Description
The Nuxeo Platform is an open source content management platform for building business applications. In version 11.5.109, the oauth2 REST API is vulnerable to Reflected Cross-Site Scripting (XSS). This XSS can be escalated to Remote Code Execution (RCE) by levering the automation API.
NVD description
The Nuxeo Platform is an open source content management platform for building business applications. In version 11.5.109, the `oauth2` REST API is vulnerable to Reflected Cross-Site Scripting (XSS). This XSS can be escalated to Remote Code Execution (RCE) by levering the automation API.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free