CVE-2021-32828

Name of the Vulnerable Software and Affected Versions Nuxeo Platform version 11.5.109

Description The Nuxeo Platform is an open source content management platform for building business applications. In the affected version, the oauth2 REST API is vulnerable to Reflected Cross-Site Scripting (XSS), which can be escalated to Remote Code Execution (RCE) by leveraging the automation API.

Recommendations For version 11.5.109, consider disabling the oauth2 REST API until a patch is available to prevent exploitation. Restrict access to the automation API to minimize the risk of Remote Code Execution (RCE).