Alkacon OpenCMS Absolute Path Traversal via pathname in filePath parameter

Description

References

• nvd.nist.gov/vuln/detail/CVE-2006-3934 · ADVISORY
• alkacon/opencms-core commit 8f1c04c · WEB
• exchange.xforce.ibmcloud.com/vulnerabilities/28000 · WEB
• alkacon/opencms-core · PACKAGE
• securityreason.com/securityalert/1302 · WEB
• opencms.org/export/download/opencms/opencms_6.2.2_src.zip · WEB
• opencms.org/opencms/en/shownews.html · WEB
• o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txt · Exploit
• secunia.com/advisories/21193 · Exploit
• securityfocus.com/archive/1/441182/100/0/threaded

Weitere Schwachstellen in org.opencms:opencms-core

• CVE-2023-42346HOCH 7.5Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.
• CVE-2023-42345MITTEL 6.1A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.
• CVE-2023-42344HOCH 7.3Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on …
• CVE-2023-42343MITTEL 6.1A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.
• CVE-2024-42699MITTEL 6.5Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript pay…