GHSA-c8j6-gqq8-4prj

Alkacon OpenCMS XSS via New User module

Source: GitHub Advisory Database (reviewed) Low CVE-2019-11818

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.opencms:opencms-core	< 11.0.0	11.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting (XSS) in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp). This allows an attacker to insert arbitrary JavaScript as user input (First Name or Last Name), which will be executed whenever the affected snippet is loaded.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-11818 advisory
https://github.com/alkacon/opencms-core/issues/635 web
https://github.com/alkacon/opencms-core/commit/b20c293aac133e110a053f1e6665a9ae82cfdeb3 web
https://github.com/alkacon/opencms-core web
https://www.openwall.com/lists/oss-security/2019/04/30/3 web