Alkacon OpenCMS XSS via title and requestedResource parameters

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2013-4600 · ADVISORY
• alkacon/opencms-core · WEB
• alkacon/opencms-core commit 72a05e3 · WEB
• alkacon/opencms-core · PACKAGE
• opencms.org/en/news/130710-opencms-v852-releasenotes.html · WEB
• archives.neohapsis.com/archives/bugtraq/2013-07/0113.html · Exploit
• htbridge.com/advisory/HTB23160 · Exploit

org.opencms:opencms-core のその他の脆弱性

• CVE-2023-42346高 7.5Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.
• CVE-2023-42345中 6.1A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.
• CVE-2023-42344高 7.3Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on …
• CVE-2023-42343中 6.1A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.
• CVE-2024-42699中 6.5Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript pay…