{"id":"CVE-2021-41791","details":"An issue was discovered in Hyland org.alfresco:share through 7.0.0.2 and org.alfresco:community-share through 7.0. An evasion of the XSS filter for HTML input validation in the Alfresco Share User Interface leads to stored XSS that could be exploited by an attacker (given that he has privileges on the content collaboration features).","modified":"2026-07-08T06:03:50.563917445Z","published":"2021-10-21T09:15:08.867Z","database_specific":{"unresolved_ranges":[{"vendor_product":"alfresco:share","cpes":["cpe:2.3:a:alfresco:share:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5.0.0.0"},{"last_affected":"5.2.7.11"},{"introduced":"5.0.0.0"},{"last_affected":"5.2.7.11"}],"source":"CPE_RANGE"}]},"references":[{"type":"ADVISORY","url":"https://github.com/Alfresco/acs-packaging/blob/master/DISCLOSURES.md"},{"type":"ADVISORY","url":"https://www.themissinglink.com.au/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/alfresco/acs-packaging","events":[{"introduced":"0"},{"last_affected":"d1378318882c7158649adbf6188758c2e366e33f"},{"last_affected":"64c931d63f38b4f5c069c1d4979fd63a9789d085"},{"last_affected":"725abb97b69834a3f8f4e1d72ebb580c07403c45"},{"last_affected":"05b86c2cbf821880acc29e191c3e6f218f67751c"},{"introduced":"d1378318882c7158649adbf6188758c2e366e33f"},{"last_affected":"396717c88bbff07f2486804b06c843076c1e789a"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"7.0"},{"introduced":"6.0.1.0"},{"last_affected":"6.0.1.2"},{"introduced":"6.0.2.0"},{"last_affected":"6.2.2.4"},{"introduced":"6.1.1.0"},{"last_affected":"6.1.1.2"},{"introduced":"7.0"},{"introduced":"7.0.0.1"},{"last_affected":"7.0.0.1"},{"introduced":"7.0.0.2"},{"last_affected":"7.0.0.2"},{"introduced":"7.0.1"},{"last_affected":"7.0.1"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:alfresco:community_share:*:*:*:*:*:*:*:*","cpe:2.3:a:alfresco:share:*:*:*:*:*:*:*:*","cpe:2.3:a:alfresco:share:7.0:*:*:*:*:*:*:*","cpe:2.3:a:alfresco:share:7.0.0.1:*:*:*:*:*:*:*","cpe:2.3:a:alfresco:share:7.0.0.2:*:*:*:*:*:*:*","cpe:2.3:a:alfresco:share:7.0.1:*:*:*:*:*:*:*"]}}],"versions":["7.0","7.0.0.1","7.0.0.2","7.0.1","7.0.1-A6","7.0.1-A5","7.0.1-A4","7.0.1-A1","7.0.0","6.2.2.4","acs-packaging-6.2.2.2","acs-packaging-6.2.2.1","acs-packaging-6.2.2","acs-packaging-6.2.2-RC1","acs-packaging-6.2.2-A2","acs-packaging-6.2.2-A1","acs-packaging-6.2.1-RC6","acs-packaging-6.2.1-RC5","acs-packaging-6.2.1-RC4","acs-packaging-6.2.1-A4","acs-packaging-6.2.1-A3","acs-packaging-6.2.1-RC3","acs-packaging-6.2.1-RC2","acs-packaging-6.2.1-RC1","acs-packaging-6.2.1-A2","acs-packaging-6.2.1-A1","acs-packaging-6.1.1.2","acs-packaging-6.2.0-RC3","acs-packaging-6.1.1.1","acs-packaging-6.2.0-RC2","acs-packaging-6.1.1","acs-packaging-6.1.1-RC3","acs-packaging-6.2.0-RC1","acs-packaging-6.2.0-A8","acs-packaging-6.1.1-RC2","acs-packaging-6.2.0-A7","acs-packaging-6.2.0-A6","acs-packaging-6.2.0-A5","acs-packaging-6.1.1-RC1","acs-packaging-6.2.0-A4","acs-packaging-6.2.0-A3","acs-packaging-6.2.0-A2","acs-packaging-6.2.0-A1","acs-packaging-6.0.1.2","acs-packaging-6.0.1.1","acs-packaging-6.0.1.1-RC1","acs-packaging-6.1.0-RC2","acs-packaging-6.0.1","acs-packaging-6.1.0-A2","acs-packaging-6.1.0-A1","acs-packaging-6.1.0-EA3","acs-packaging-6.1.0-EA2","acs-packaging-6.1.0-EA1","acs-packaging-6.0.0","acs-packaging-6.0.0-RC6","acs-packaging-6.0.0-RC5","acs-packaging-6.0.0-RC4","acs-packaging-6.0.0-RC3","acs-packaging-6.0.0-RC2","acs-packaging-6.0.0-RC1","acs-packaging-6.0.0-EA1","acs-packaging-6.0.0-testRc7","acs-packaging-6.0.0-testRc6","acs-packaging-6.0.0-testRc4","acs-packaging-6.0.0-testRC3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41791.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/alfresco/alfresco-community-share","events":[{"introduced":"0"},{"last_affected":"5e74a6cd808dd94d257b89e3e734e52b3ce3759c"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"7.0"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:alfresco:community_share:*:*:*:*:*:*:*:*"}}],"versions":["alfresco-share-parent-7.0.0","alfresco-share-parent-7.0.0-M3","alfresco-share-parent-7.0.0-A14","alfresco-share-parent-7.0.0-A13","alfresco-share-parent-7.0.0-A12","alfresco-share-parent-7.0.0-A11","alfresco-share-parent-7.0.0-A10","alfresco-share-parent-7.0.0-A8","alfresco-share-parent-7.0.0-A7","alfresco-share-parent-7.0.0-A6","alfresco-share-parent-7.0.0-A5","alfresco-share-parent-7.0.0-A4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41791.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/alfresco/share","events":[{"introduced":"eaaca6f453db6535813e8f6c8a85cb315e7fb91e"},{"last_affected":"77cd2b9afe571861c1f9184cf83650445d31bdc0"}],"database_specific":{"cpe":["cpe:2.3:a:alfresco:share:7.0:*:*:*:*:*:*:*","cpe:2.3:a:alfresco:share:7.0.0.1:*:*:*:*:*:*:*","cpe:2.3:a:alfresco:share:7.0.0.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0"},{"last_affected":"7.0"},{"introduced":"7.0.0.1"},{"last_affected":"7.0.0.1"},{"introduced":"7.0.0.2"},{"last_affected":"7.0.0.2"}],"source":"CPE_STRING"}}],"versions":["7.0","7.0.0.1","7.0.0.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41791.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}