Alkacon OpenCms allows remote unauthenticated attackers to obtain sensitive information

HOCH 7.3CVE-2023-42344 · GHSA-rcc6-6q2f-m2cw · Published 08/05/2026 · updated 28/10/2026

Kurz gesagt

CVE-2023-42344 ist eine Schwachstelle (HOCH (CVSS 7.3)) in org.opencms:opencms-core.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.3%, höher als bei 83.6% aller Schwachstellen.
Abhilfe: auf 10.5.1 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.opencms:opencms-core Maven	`< 10.5.1`	`10.5.1`

Description

Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.

NVD description

Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.

References

nvd.nist.gov/vuln/detail/CVE-2023-42344 · ADVISORY
projectdiscovery/nuclei-templates · WEB
alkacon/opencms-core · PACKAGE
labs.watchtowr.com/xxe-you-can-depend-on-me-opencms · WEB
labs.watchtowr.com/xxe-you-can-depend-on-me-opencms

Weitere Schwachstellen in org.opencms:opencms-core

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.opencms:opencms-core

Maven

< 10.5.1

10.5.1

Description

Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.

NVD description

Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.

Weitere Schwachstellen in org.opencms:opencms-core

Alle anzeigen →