PT-2023-32634 · Alkacon · Opencms

Miguel Segovia Gil · Publicado 2023-12-13 · Atualizado 2023-12-15 · CVE-2023-6379

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Alkacon Software Open CMS versions 14 through 15 of the 'Mercury' template

Description A cross-site scripting (XSS) issue affects the software, allowing a remote attacker to send a specially crafted JavaScript payload to a victim, potentially taking partial control of their browsing session.

Recommendations For versions 14 and 15 of the 'Mercury' template, consider disabling JavaScript execution from untrusted sources as a temporary workaround until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of exploitation. Avoid using the application with the 'Mercury' template until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-6379

GHSA-W62V-Q77R-66CC

Produtos afetados

Opencms

Referências · 10

• https://github.com/alkacon/opencms-core · Nota
• https://github.com/alkacon/opencms-core/commit/d965c18ac6d24ad75bfea272edb8b2efd4290afa · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-6379 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1734932202675167433 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1734894379859681612 · Publicação no Twitter
• https://t.me/cvenotify/63832 · Publicação no Telegram
• https://t.me/cvenotify/63426 · Publicação no Telegram
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alkacon-software-opencms · Nota
• https://osv.dev/vulnerability/GHSA-w62v-q77r-66cc · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-6379 · Aviso do Fabricante