high7.3
CVE-2023-42344
Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.
Impact
Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.opencms:opencms-core | < 10.5.1 | 10.5.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-rcc6-6q2f-m2cw
- https://nvd.nist.gov/vuln/detail/CVE-2023-42344
- https://labs.watchtowr.com/xxe-you-can-depend-on-me-opencms
- https://github.com/projectdiscovery/nuclei-templates/issues/8864
- https://labs.watchtowr.com/xxe-you-can-depend-on-me-opencms/