CyberSec.Space Logo
Back to CVE Browser

CVE-2021-32828

MEDIUM
5.4
CVSS Severity Score
EPSS Score0.1940%
EPSS Percentile14.93th
PublishedJan 5, 2023
Last ModifiedNov 21, 2024

Vulnerability Description

The Nuxeo Platform is an open source content management platform for building business applications. In version 11.5.109, the `oauth2` REST API is vulnerable to Reflected Cross-Site Scripting (XSS). This XSS can be escalated to Remote Code Execution (RCE) by levering the automation API.

Affected Platforms (CPE)

📦
Hyland

Nuxeo

<= 11.5.109

References & Advisories

🔗 https://github.com/nuxeo/nuxeo/blob/master/modules/platform/nuxeo-platform-oauth/src/main/java/org/nuxeo/ecm/webengine/oauth2/OAuth2Callback.java
🔗 https://securitylab.github.com/advisories/GHSL-2021-072-nuxeo
🔗 https://github.com/nuxeo/nuxeo/blob/master/modules/platform/nuxeo-platform-oauth/src/main/java/org/nuxeo/ecm/webengine/oauth2/OAuth2Callback.java
🔗 https://securitylab.github.com/advisories/GHSL-2021-072-nuxeo

Related Vulnerabilities

CVE-2013-45219.8

RichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not restrict the classes for which deseri...

CVE-2017-58698.8

Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote authenticated ...

CVE-2026-121917.8

A vulnerability was found in Comma AI Openpilot 0.11. This issue affects the function pickle.load/pickle.loads of the file selfdri...

CVE-2026-121905.3

A vulnerability has been found in Genspark AI Workspace App 2.8.4 on Android. This vulnerability affects unknown code of the compo...