CVE-2023-42343
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A Cross-Site Scripting (XSS) vulnerability exists in Alkacon OpenCms before 10.5.1 via cmis-online/type.
Risk Assessment
Potential execution of malicious script in a user's browser, session or data theft, and page content modification.
Recommendation
Update OpenCms to version 10.5.1 or later. Additionally, implement input validation and encoding.
Other vulnerabilities in OpenCms
See all- CVE-2026-38429Critical
OpenCMS version 20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user-supplied .zip files containing a manifest.xml.
- CVE-2023-42345Medium
A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp. The vulnerability may allow an attacker to inject malicious script.
Original NVD description (English source)
A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS