CVE-2020-12873

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-19 · updated 2026-06-17
Weakness: CWE-74

Description

An issue was discovered in Alfresco Enterprise Content Management (ECM) before 6.2.1. A user with privileges to edit a FreeMarker template (e.g., a webscript) may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running Alfresco.

Affected products

Atlassian Alfresco Enterprise Content Management: before 6.2.1 — fixed in 6.2.1

How to fix

Upgrade to a fixed version: Atlassian Alfresco Enterprise Content Management 6.2.1. Check the vendor advisory for mitigations.

References

https://issues.alfresco.com/jira/browse/MNT-21510
https://securitylab.github.com/advisories/GHSL-2020-039-alfresco
https://issues.alfresco.com/jira/browse/MNT-21510
https://securitylab.github.com/advisories/GHSL-2020-039-alfresco

Get alerted when CVE-2020-12873 or the next vulnerability affects your stack