Описание
An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.
Ссылки
- ExploitIssue TrackingThird Party Advisory
- Release NotesThird Party Advisory
- ExploitIssue TrackingThird Party Advisory
- Release NotesThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:alkacon:opencms:11.0:-:*:*:*:*:*:*
cpe:2.3:a:alkacon:opencms:11.0.1:*:*:*:*:*:*:*
cpe:2.3:a:alkacon:opencms:11.0.2:*:*:*:*:*:*:*
EPSS
Процентиль: 64%
0.00476
Низкий
6.5 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-611
Связанные уязвимости
CVSS3: 6.5
github
больше 4 лет назад
XML External Entity Reference in org.opencms:opencms-core
EPSS
Процентиль: 64%
0.00476
Низкий
6.5 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-611