PT-2019-12505 · Alkacon · Opencms

Pramod Rana · Publicado 2019-05-08 · Atualizado 2022-05-24 · CVE-2019-11818

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Alkacon OpenCMS versions 10.5.4 and before

Description The issue concerns stored cross-site scripting (XSS) in the New User module, specifically at the "/opencms/system/workplace/admin/accounts/user new.jsp" endpoint. An attacker can insert arbitrary JavaScript as user input, such as in the First Name or Last Name fields, which will be executed whenever the affected snippet is loaded.

Recommendations For versions 10.5.4 and before, consider disabling the New User module until a patch is available to prevent exploitation of the stored XSS issue. Restrict access to the "/opencms/system/workplace/admin/accounts/user new.jsp" endpoint to minimize the risk of arbitrary JavaScript execution. Avoid using the First Name and Last Name fields in the New User module until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-11818

GHSA-C8J6-GQQ8-4PRJ

Produtos afetados

Opencms

Referências · 7

• 🔥 https://github.com/alkacon/opencms-core/issues/635 · Exploit
• 🔥 https://openwall.com/lists/oss-security/2019/04/30/3 · Exploit
• https://github.com/alkacon/opencms-core · Nota
• https://github.com/alkacon/opencms-core/commit/b20c293aac133e110a053f1e6665a9ae82cfdeb3 · Nota
• https://osv.dev/vulnerability/CVE-2019-11818 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11818 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-c8j6-gqq8-4prj · Aviso do Fabricante