GHSA-36hf-6hp2-9g4c

Local file inclusion allows unauthorized access to internal resources in Alkacon OpenCms

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-13237

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.opencms:opencms-core	< 11.0.1	11.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-13237 advisory
https://aetsu.github.io/OpenCms web
https://github.com/alkacon/opencms-core package
https://github.com/alkacon/opencms-core/commits/branch_10_5_x web
http://packetstormsecurity.com/files/154281/Alkacon-OpenCMS-10.5.x-Local-File-Inclusion.html web