Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to a victim and partially take control of their browsing session.

According to its self-reported version number, the detected OpenCMS application is affected by multiple vulnerabilities :

- An Open redirect vulnerability due to the fact that there is no proper sanitization of the 'URI' parameter.

- A Cross-site scripting (XSS) vulnerability in the 'Mercury' template.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the
    'Mercury' template. This vulnerability could allow a remote attacker to send a specially crafted
    JavaScript payload to a victim and partially take control of their browsing session. (CVE-2023-6379)

ID	Name	Product	Family	Severity
115134	OpenCMS 14.0.0 < 16.0.0 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
437292	SCA: security update for org.opencms:opencms-core (GHSA-w62v-q77r-66cc)	Tenable Cloud Security	SCA Checks	medium
437292	SCA: security update for org.opencms:opencms-core (GHSA-w62v-q77r-66cc)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2023-6379

medium

Tenable Plugins

medium

medium

medium