oss-security - CVE Request - Multiple vulnerabilities in Activiti Explorer

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAOJmqsBw6V5m4NbHzX4-KLhjgZqmzHLem_ZfTrgiwx9SBc979g@mail.gmail.com>
Date: Fri, 29 Apr 2016 10:26:00 +1000
From: Brendan Scarvell <bscarvell@....net>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: CVE Request - Multiple vulnerabilities in Activiti Explorer

Good morning

I've discovered a stored XSS and an XXE vulnerability in Alfresco's Activi
Explorer.

Comments created for "tasks" aren't having HTML characters sanitized
correctly resulting in a stored XSS being executed when any user visits the
page.

Activiti Explorer also has the parsing of external entities enabled and
I've noticed that deployments tab is vulnerable to XXE. An attacker is able
to upload malicious XML files to read arbitrary files off the server.

I've attempted to report the issue to the vendor several times, however
have received no response.

Timeline:
March 11  - Contacted vendor, no response
March 17  - Contacted vendor, no response.
March 24  - Contacted vendor, no response
April 1      - Contacted vendor, no response
April 15    - Contacted vendor, gave deadline for April 29th.
April 29th - Still no response

Could a CVE ID please be assigned to these issues.

Thanks,

Brendan Scarvell

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.