Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via
    a cmis-online/query XXE attack on a Chemistry servlet. (CVE-2023-42344)

According to its self-reported version number, the detected OpenCMS application is affected by multiple vulnerabilities :

- An unauthenticated XML External Entity that an attackers can leverage to a Remote Code Execution

- An unauthenticated Cross-Site Scripting (XSS) vulnerability in id parameter

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
441833	SCA: security update for org.opencms:opencms-core (GHSA-rcc6-6q2f-m2cw)	Tenable Cloud Security	SCA Checks	high
441833	SCA: security update for org.opencms:opencms-core (GHSA-rcc6-6q2f-m2cw)	Tenable Self-Hosted Container Security	SCA Checks	high
114245	OpenCMS < 10.5.1 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	high

Detections

Analytics

CVE-2023-42344

high

Tenable Plugins

high

high

high