Description

Cross-site scripting (XSS) vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image.

Remediation

References

https://github.com/alkacon/opencms-core/issues/587

https://www.exploit-db.com/exploits/44392/

Related Vulnerabilities

CVE-2023-40350 Vulnerability in maven package org.jenkins-ci.plugins:docker-swarm

CVE-2023-32314 Vulnerability in maven package org.webjars.npm:vm2

CVE-2023-34465 Vulnerability in maven package org.xwiki.platform:xwiki-platform-security-authorization-bridge

CVE-2017-1000190 Vulnerability in maven package org.simpleframework:simple-xml

CVE-2017-12629 Vulnerability in maven package org.apache.lucene:lucene-queryparser

Severity

Medium

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Tags

Exploit Third Party Advisory VDB Entry