PT-2021-20053 · Alkacon · Alkacon Opencms

Gwestenberger · Published 2021-10-08 · Updated 2021-10-15 · CVE-2021-3312

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Alkacon OpenCms versions 11.0 through 11.0.2

Description An XML external entity (XXE) issue allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.

Recommendations For versions 11.0 through 11.0.2, update to a version that includes a fix for this issue to prevent file exfiltration. As a temporary workaround, consider restricting the upload of SVG documents or limiting edit privileges to trusted users until a patch is available.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-3312

GHSA-G6V7-VQHX-6V6C

Affected Products

Alkacon Opencms

References · 9

• 🔥 https://github.com/alkacon/opencms-core/issues/725 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-3312 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3312 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g6v7-vqhx-6v6c · Vendor Advisory
• https://github.com/alkacon/opencms-core · Note
• https://github.com/alkacon/opencms-core/releases · Note
• https://github.com/alkacon/opencms-core/commit/92e035423aa6967822d343e54392d4291648c0ee · Note
• https://github.com/alkacon/opencms-core/issues/721 · Note
• https://t.me/cibsecurity/30245 · Telegram Post