Advisories for Maven/Org.alfresco/Alfresco-Content-Services package

An issue was discovered in Hyland org.alfresco:alfresco-content-services and org.alfresco:alfresco-transform-services A crafted HTML file, once uploaded, could trigger an unexpected request by the transformation engine. The response to the request is not available to the attacker, i.e., this is blind SSRF.

An issue was discovered in Hyland org.alfresco:alfresco-content-services Script Action execution allows executing scripts uploaded outside of the Data Dictionary. This could allow a logged-in attacker to execute arbitrary code inside a sandboxed environment.