Description
An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.
Remediation
References
https://github.com/alkacon/opencms-core/issues/725
https://github.com/alkacon/opencms-core/releases
Related Vulnerabilities
CVE-2020-10199 Vulnerability in maven package org.sonatype.nexus:nexus-extdirect
CVE-2022-36908 Vulnerability in maven package org.jenkins-ci.plugins:openshift-deployer
CVE-2020-24750 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2021-31811 Vulnerability in maven package org.apache.pdfbox:pdfbox
CVE-2017-12629 Vulnerability in maven package org.apache.solr:solr-core