CVE-2019-14223

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N. The Alfresco Share application is vulnerable to an Open Redirect attack via a crafted POST request. By manipulating the POST parameters, an attacker can redirect a victim to a malicious website over any protocol the attacker desires (e.g.,http, https, ftp, smb, etc.).

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://community.alfresco.com/content?filterID=all~objecttype~thread%5Bquestions%5DVendor Advisory
https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14223-Open%20Redirect%20in%20Alfresco%20Share-Alfresco%20CommunityExploit, Third Party Advisory
https://community.alfresco.com/content?filterID=all~objecttype~thread%5Bquestions%5DVendor Advisory
https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14223-Open%20Redirect%20in%20Alfresco%20Share-Alfresco%20CommunityExploit, Third Party Advisory

Timeline

Published: Sep 6, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-142247.2An issue was discovered in Alfresco Community Edition 5.2 201707. By leveraging multiple components in the Alfresco Software applications, a CVE-2019-142255.4OX App Suite 7.10.1 and 7.10.2 allows SSRF.CVE-2019-142268.1OX App Suite through 7.10.2 has Insecure Permissions.CVE-2019-142276.1OX App Suite 7.10.1 and 7.10.2 allows XSS.CVE-2019-142286.1Xavier PHP Management Panel 3.0 is vulnerable to Reflected POST-based XSS via the username parameter when registering a new user at admin/in CVE-2019-14237.8An elevation of privilege vulnerability exists in the way that the StartTileData.dll handles file creation in protected locations, aka 'Wind CVE-2019-142309.8An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress. One could exploit the id parameter in the set CVE-2019-142319.8An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress. One could exploit the points parameter in the CVE-2019-142327.5An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars CVE-2019-142337.5An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying CVE-2019-142349.8An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transfo CVE-2019-142357.5An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils