Siebene

**Name of the Vulnerable Software and Affected Versions** Alfresco Content Services version 23.3.0.7 **Description** An issue in Alfresco Content Services allows a remote attacker to execute arbitrary code via the Transfer Service. **Recommendations** For Alfresco Content Services version 23.3.0.7, consider disabling the Transfer Service as a temporary workaround until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Apache OFBiz versions prior to 18.12.10 **Description** The issue is related to a pre-authentication remote code execution vulnerability in Apache OFBiz due to the presence of unmaintained XML-RPC. This vulnerability allows an attacker to execute arbitrary code remotely. The estimated number of potentially affected devices worldwide is around 1,920, mainly distributed in the United States, China, and other countries. There have been reports of this issue being exploited in the wild, with attackers gaining full control over the server and potentially siphoning sensitive data. **Recommendations** For Apache OFBiz versions prior to 18.12.10, users are recommended to upgrade to version 18.12.10 to resolve the issue. As a temporary workaround, consider disabling the XML-RPC functionality until a patch is available. Restrict access to the vulnerable webtools/control/xmlrpc endpoint to minimize the risk of exploitation. Avoid using the vulnerable XML-RPC functionality in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Apache Jackrabbit versions 2.20.10 and earlier (stable branch) Apache Jackrabbit versions 2.21.17 and earlier (unstable branch) **Description** A Java object deserialization issue in Apache Jackrabbit webapp/standalone on all platforms allows an attacker to remotely execute code via RMI. The issue is related to the component "commons-beanutils", which contains a class that can be used for remote code execution over RMI. Users are advised to immediately update to versions 2.20.11 or 2.21.18. In general, RMI support can expose vulnerabilities by the mere presence of an exploitable class on the classpath. The native RMI protocol by default uses port 1099. RMI-over-HTTP in Jackrabbit by default uses the path "/rmi". To check whether RMI support is enabled, tools like "netstat" can be used to check the native RMI protocol, and an HTTP GET request can be used to check RMI-over-HTTP. **Recommendations** To resolve the issue for versions 2.20.10 and earlier (stable branch), update to version 2.20.11. To resolve the issue for versions 2.21.17 and earlier (unstable branch), update to version 2.21.18. As a temporary workaround, consider disabling RMI access altogether by removing the declaration and the mapping definition for the RemoteBindingServlet in the web.xml file and setting rmi.enabled=false in the bootstrap.properties file.

**Name of the Vulnerable Software and Affected Versions** Openfire versions 3.10.0 through 4.6.7 Openfire versions 4.7.0 through 4.7.4 **Description** The administrative console of Openfire, a web-based application, is susceptible to a path traversal attack via the setup environment. This occurs because path traversal protections did not account for non-standard URL encoding of UTF-16 characters supported by the embedded webserver. By combining this with wildcard pattern matching in the API's authentication exclusion mechanism, an unauthenticated user can access restricted administrative pages. This flaw has been exploited in the wild by Kinsing malware and other attackers to create unauthorized administrator accounts, install malicious Java plugins (JAR files) to execute shell commands via GET and POST requests, and deploy cryptominers or backdoors. Over 3,000 servers were reported as vulnerable. The issue can be tested by accessing the endpoint '/setup/setup-s/%u002e%u002e/%u002e%u002e/log.jsp'. **Recommendations** Upgrade to version 4.6.8, 4.7.5, or 4.8.0. Restrict network access to the Admin Console using firewalls or ACLs to ensure it is not exposed to the general internet, specifically restricting ports 9090 and 9091. Modify the `plugins/admin/webapp/WEB-INF/web.xml` file by removing all asterisk (`*`) characters from the `param-value` of the `AuthCheck` filter. Bind the admin console to the loopback interface by adding the `<interface>127.0.0.1</interface>` element to the `<adminConsole>` section in the `conf/openfire.xml` file. Install the AuthFilterSanitizer plugin to periodically remove entries susceptible to abuse. Update the Random Avatar plugin to version 1.1.0 or later, the Monitoring Service plugin to version 2.5.0 or later, and the HTTP File Upload plugin to version 1.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** net.sourceforge.htmlunit:htmlunit versions 0 through 3.0.0 **Description** The issue is related to incorrect code generation management in the HtmlUnit browser, which can be exploited to execute arbitrary code remotely via XSTL when browsing an attacker's webpage. This can allow a remote attacker to execute arbitrary code. **Recommendations** For versions 0 through 3.0.0, update to a version later than 3.0.0 to resolve the issue. As a temporary workaround, consider restricting access to web pages that may exploit this vulnerability until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Concrete versions 8.5.7 and below Concrete versions 9.0 through 9.0.2 **Description** The issue allows traversal in `/index.php/ccm/system/file/upload` which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing `/index.php/ccm/system/file/upload` to ensure Concrete doesn’t allow traversal and by changing `isFullChunkFilePresent` to have an early false return when input doesn't match expectations. **Recommendations** For Concrete versions 8.5.7 and below, update to a version above 8.5.7 to resolve the issue. For Concrete versions 9.0 through 9.0.2, update to a version above 9.0.2 to resolve the issue. As a temporary workaround, consider restricting access to the `/index.php/ccm/system/file/upload` endpoint until a patch is available. Restrict input to the `isFullChunkFilePresent` function to minimize the risk of exploitation.