GHSA-g6v7-vqhx-6v6c

XML External Entity Reference in org.opencms:opencms-core

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-3312

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.opencms:opencms-core	>= 11.0.0, < 12.0.0	12.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-3312 advisory
https://github.com/alkacon/opencms-core/issues/721 web
https://github.com/alkacon/opencms-core/issues/725 web
https://github.com/alkacon/opencms-core/commit/92e035423aa6967822d343e54392d4291648c0ee web
https://github.com/alkacon/opencms-core package
https://github.com/alkacon/opencms-core/releases web