CVE-2020-12873

An issue was discovered in Alfresco Enterprise Content Management ECM before 6.2.1. A user with privileges to edit a FreeMarker template e.g., a webscript may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running Alfresco...

Design/Logic Flaw

An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE...

CVE-2020-12873

Alfresco Enterprise Content Management (ECM) before 6.2.1 is affected. A user with permissions to edit a FreeMarker template (e.g., a webscript) can execute arbitrary Java code or run arbitrary system commands with the same privileges as the Alfresco process, enabling code execution and potential...