medium6.5
CVE-2021-3312
XML External Entity Reference in org.opencms:opencms-core
Impact
An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.opencms:opencms-core | >= 11.0.0, <= 11.0.2 | 12.0.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Alkacon | Opencms | Versions 11.0, 11.0.1, 11.0.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/alkacon/opencms-core/issues/725
- https://github.com/alkacon/opencms-core/releases
- https://github.com/advisories/GHSA-g6v7-vqhx-6v6c
- https://nvd.nist.gov/vuln/detail/CVE-2021-3312
- https://github.com/alkacon/opencms-core/issues/721
- https://github.com/alkacon/opencms-core/commit/92e035423aa6967822d343e54392d4291648c0ee