CVE-2019-14222

An issue was discovered in Alfresco Community Edition versions 6.0 and lower. An unauthenticated, remote attacker could authenticate to Alfresco's Solr Web Admin Interface. The vulnerability is due to the presence of a default private key that is present in all default installations. An attacker could exploit this vulnerability by using the extracted private key and bundling it into a PKCS12. A successful exploit could allow the attacker to gain information about the target system (e.g., OS type, system file locations, Java version, Solr version, etc.) as well as the ability to launch further attacks by leveraging the access to Alfresco's Solr Web Admin Interface.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14222-Default%20Certificate-Alfresco%20Community	Exploit Third Party Advisory
https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14222-Default%20Certificate-Alfresco%20Community	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:alfresco:alfresco:*:*:*:*:community:*:*:*

History

21 Nov 2024, 04:26

Type	Values Removed	Values Added
References	~~() https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14222-Default%20Certificate-Alfresco%20Community - Exploit, Third Party Advisory~~	() https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14222-Default%20Certificate-Alfresco%20Community - Exploit, Third Party Advisory

Information

Published : 2019-09-05 22:15

Updated : 2024-11-21 04:26

NVD link : CVE-2019-14222

Mitre link : CVE-2019-14222

CVE.ORG link : CVE-2019-14222

JSON object : View

Products Affected

alfresco

alfresco

CWE

CWE-1188

Insecure Default Initialization of Resource

{"id": "CVE-2019-14222", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-09-05T22:15:11.320", "references": [{"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14222-Default%20Certificate-Alfresco%20Community", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14222-Default%20Certificate-Alfresco%20Community", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-1188"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Alfresco Community Edition versions 6.0 and lower. An unauthenticated, remote attacker could authenticate to Alfresco's Solr Web Admin Interface. The vulnerability is due to the presence of a default private key that is present in all default installations. An attacker could exploit this vulnerability by using the extracted private key and bundling it into a PKCS12. A successful exploit could allow the attacker to gain information about the target system (e.g., OS type, system file locations, Java version, Solr version, etc.) as well as the ability to launch further attacks by leveraging the access to Alfresco's Solr Web Admin Interface."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Alfresco Community Edition versiones 6.0 y anteriores. Un atacante remoto no autenticado podr\u00eda autenticarse en la Interfaz de Administraci\u00f3n Web Solr de Alfresco. La vulnerabilidad es debido a la presencia de una clave privada predeterminada que est\u00e1 presente en todas las instalaciones predeterminadas. Un atacante podr\u00eda explotar esta vulnerabilidad mediante el uso de la clave privada extra\u00edda y empaquet\u00e1ndola en un PKCS12. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante conseguir informaci\u00f3n sobre el sistema apuntado (por ejemplo, tipo de Sistema Operativo, ubicaciones de archivos del sistema, versi\u00f3n de Java, versi\u00f3n de Solr, etc.), as\u00ed como tambi\u00e9n la capacidad para activar nuevos ataques mediante el aprovechamiento del acceso a la Interfaz de Administraci\u00f3n Web Solr de Alfresco."}], "lastModified": "2024-11-21T04:26:13.840", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:alfresco:alfresco:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "9378C003-2D84-40EF-89AF-7CFCE7EB353E", "versionEndIncluding": "6.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}