PT-2021-16892 · Opencms · Opencms

Published 2021-10-19 · Updated 2021-10-21 · CVE-2021-25968

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenCMS versions 10.5.0 through 11.0.2

Description The issue allows low privileged application users to store malicious scripts in the Sitemap functionality. These scripts are executed in a victim’s browser when they open the page containing the vulnerable field.

Recommendations For OpenCMS versions 10.5.0 through 11.0.2, consider disabling the Sitemap functionality until a patch is available to prevent the storage and execution of malicious scripts. Restrict access to the Sitemap feature to minimize the risk of exploitation. Avoid using the vulnerable field in the Sitemap functionality until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-25968

Affected Products

Opencms

References · 5

• https://github.com/alkacon/mercury-template/commit/800945f5d02346c633c7aef9f5d596d7dedc8fb5 · Patch
• https://osv.dev/vulnerability/CVE-2021-25968 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25968 · Security Note
• https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25968 · Note
• https://t.me/cibsecurity/30747 · Telegram Post