PT-2019-12505 · Alkacon · Opencms

Pramod Rana · Published 2019-05-08 · Updated 2022-05-24 · CVE-2019-11818

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Alkacon OpenCMS versions 10.5.4 and before

Description The issue concerns stored cross-site scripting (XSS) in the New User module, specifically at the "/opencms/system/workplace/admin/accounts/user new.jsp" endpoint. An attacker can insert arbitrary JavaScript as user input, such as in the First Name or Last Name fields, which will be executed whenever the affected snippet is loaded.

Recommendations For versions 10.5.4 and before, consider disabling the New User module until a patch is available to prevent exploitation of the stored XSS issue. Restrict access to the "/opencms/system/workplace/admin/accounts/user new.jsp" endpoint to minimize the risk of arbitrary JavaScript execution. Avoid using the First Name and Last Name fields in the New User module until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-11818

GHSA-C8J6-GQQ8-4PRJ

Affected Products

Opencms

References · 7

• 🔥 https://github.com/alkacon/opencms-core/issues/635 · Exploit
• 🔥 https://openwall.com/lists/oss-security/2019/04/30/3 · Exploit
• https://osv.dev/vulnerability/CVE-2019-11818 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11818 · Security Note
• https://osv.dev/vulnerability/GHSA-c8j6-gqq8-4prj · Vendor Advisory
• https://github.com/alkacon/opencms-core · Note
• https://github.com/alkacon/opencms-core/commit/b20c293aac133e110a053f1e6665a9ae82cfdeb3 · Note