CVE-2023-42345
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp. The vulnerability may allow an attacker to inject malicious script.
Risk Assessment
The XSS vulnerability may allow an attacker to execute malicious script in the victim's browser, potentially leading to session or data theft. The risk affects OpenCms users before version 16.
Recommendation
Update Alkacon OpenCms to version 16 or later. Also implement input validation and encoding mechanisms.
Other vulnerabilities in OpenCms
See all- CVE-2026-38429Critical
OpenCMS version 20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user-supplied .zip files containing a manifest.xml.
- CVE-2023-42343Medium
A Cross-Site Scripting (XSS) vulnerability exists in Alkacon OpenCms before 10.5.1 via cmis-online/type.
Original NVD description (English source)
A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS