Alkacon OpenCms allows remote unauthenticated attackers to obtain sensitive information

Description

References

• nvd.nist.gov/vuln/detail/CVE-2023-42344 · ADVISORY
• projectdiscovery/nuclei-templates · WEB
• alkacon/opencms-core · PACKAGE
• labs.watchtowr.com/xxe-you-can-depend-on-me-opencms · WEB
• labs.watchtowr.com/xxe-you-can-depend-on-me-opencms

More vulnerabilities in org.opencms:opencms-core

• CVE-2023-42346HIGH 7.5Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.
• CVE-2023-42345MEDIUM 6.1A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.
• CVE-2023-42343MEDIUM 6.1A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.
• CVE-2024-42699MEDIUM 6.5Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript pay…
• CVE-2024-41446MEDIUM 5.4A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a c…