I want to know if any of the following vulnerabilities can be exploited with Alfresco?
https://www.cve.org/CVERecord?id=CVE-2020-11022https://www.cve.org/CVERecord?id=CVE-2021-23450https://www.cve.org/CVERecord?id=CVE-2021-41182
These were found in Alfresco Community 23.1 version.
We keep an eye on the CVEs and scan Alfresco with the usual tools. Not every security issue in a library we use can be exploited. You can find our security policy at https://docs.alfresco.com/support/latest/policies/security/ .
As a rule, we do not communicate about individual CVEs. The latest service pack is always up-to-date with our security fixes, my recommendation is to deploy 23.5 or wait just a week to go to 23.6.
Thank you for the information! So I guess we can assume that if a library version used in Alfresco has an old vulnerability finding (like in this case), the vulnerability is not exploitable in Alfresco. Otherwise it would have been updated.
