CVE-2023-42344
HighCVSS 7.3Exploitation Probability (EPSS)
High risk84th percentile - higher than 84% of all known CVEs
Summary
Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.
Risk Assessment
Attackers can exploit this vulnerability to exfiltrate sensitive data, potentially leading to serious security breaches for the organization.
Recommendation
It is recommended to upgrade OpenCms to version 10.5.1 or later to mitigate this vulnerability.
Other vulnerabilities in Alkacon OpenCms
See all- CVE-2023-42346High
Alkacon OpenCms before version 16 allows XXE when the <!DOCTYPE> refers to an external host.
- CVE-2024-41446Medium
A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the image parameter under the Create/Modify article function.
Original NVD description (English source)
Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS