CVE-2019-14223

An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N. The Alfresco Share application is vulnerable to an Open Redirect attack via a crafted POST request. By manipulating the POST parameters, an attacker can redirect a victim to a malicious website over any protocol the attacker desires (e.g.,http, https, ftp, smb, etc.).

• CWE-601

• https://community.alfresco.com/content?filterID=all~objecttype~thread%5Bquestions%5DVendor Advisory
• https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14223-Open%20Redirect%20in%20Alfresco%20Share-Alfresco%20CommunityExploit, Third Party Advisory
• https://community.alfresco.com/content?filterID=all~objecttype~thread%5Bquestions%5DVendor Advisory
• https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14223-Open%20Redirect%20in%20Alfresco%20Share-Alfresco%20CommunityExploit, Third Party Advisory

Published

Sep 6, 2019

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-14215An issue was discovered in Foxit PhantomPDF before 8.3.11. T…
• CVE-2019-14216An issue was discovered in the svg-vector-icon-plugin (aka W…
• CVE-2019-1422An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2019-14220An issue was discovered in BlueStacks 4.110 and below on mac…6.5
• CVE-2019-142211CRM On-Premise Software 8.5.7 allows XSS via a payload that…
• CVE-2019-14222An issue was discovered in Alfresco Community Edition versio…
• CVE-2019-14224An issue was discovered in Alfresco Community Edition 5.2 20…
• CVE-2019-14225OX App Suite 7.10.1 and 7.10.2 allows SSRF.5.4
• CVE-2019-14226OX App Suite through 7.10.2 has Insecure Permissions.8.1
• CVE-2019-14227OX App Suite 7.10.1 and 7.10.2 allows XSS.6.1
• CVE-2019-14228Xavier PHP Management Panel 3.0 is vulnerable to Reflected P…
• CVE-2019-1423An elevation of privilege vulnerability exists in the way th…7.8