GHSA-gj9c-69cm-7c37

Alkacon OpenCms XSS via unsanitized message body

Source: GitHub Advisory Database (reviewed) Low CVE-2006-3933

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.opencms:opencms-core	< 6.2.2	6.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

Cross-site scripting (XSS) vulnerability in Alkacon OpenCms before 6.2.2 allows remote authenticated users to inject arbitrary web script or HTML via the message body.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2006-3933 advisory
https://github.com/alkacon/opencms-core/commit/e2d3754ef27e8e8e122700bdb3f59e6e15995bae web
https://exchange.xforce.ibmcloud.com/vulnerabilities/28033 web
https://github.com/alkacon/opencms-core web
http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txt web
http://securityreason.com/securityalert/1302 web
http://www.opencms.org/opencms/en/shownews.html?id=1002 web