Description
An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.
Remediation
References
https://github.com/alkacon/opencms-core/issues/725
https://github.com/alkacon/opencms-core/releases
Related Vulnerabilities
CVE-2023-40340 Vulnerability in maven package org.jenkins-ci.plugins:nodejs
CVE-2022-24289 Vulnerability in maven package org.apache.cayenne:cayenne-server
CVE-2021-46062 Vulnerability in maven package net.mingsoft:ms-mcms
CVE-2022-3423 Vulnerability in npm package nocodb
CVE-2021-23346 Vulnerability in npm package html-parse-stringify2