CVE-2023-31544

Опубликовано: 16 мая 2023

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module.

Ссылки

https://github.com/alkacon/opencms-core/commit/21bfbeaf6b038e2c03bb421ce7f0933dd7a7633e
Patch
https://github.com/alkacon/opencms-core/issues/652
Exploit
Issue Tracking
Third Party Advisory
https://github.com/alkacon/opencms-core/commit/21bfbeaf6b038e2c03bb421ce7f0933dd7a7633e
Patch
https://github.com/alkacon/opencms-core/issues/652
Exploit
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:alkacon:opencms:11.0:-:*:*:*:*:*:*

cpe:2.3:a:alkacon:opencms:11.0:beta:*:*:*:*:*:*

cpe:2.3:a:alkacon:opencms:11.0:beta2:*:*:*:*:*:*

cpe:2.3:a:alkacon:opencms:11.0:rc:*:*:*:*:*:*

EPSS

Процентиль: 25%

0.00085

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-m44f-9jhg-59cr