PT-2023-32634 · Alkacon · Opencms

Miguel Segovia Gil · Published 2023-12-13 · Updated 2023-12-15 · CVE-2023-6379

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Alkacon Software Open CMS versions 14 through 15 of the 'Mercury' template

Description A cross-site scripting (XSS) issue affects the software, allowing a remote attacker to send a specially crafted JavaScript payload to a victim, potentially taking partial control of their browsing session.

Recommendations For versions 14 and 15 of the 'Mercury' template, consider disabling JavaScript execution from untrusted sources as a temporary workaround until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of exploitation. Avoid using the application with the 'Mercury' template until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-6379

GHSA-W62V-Q77R-66CC

Affected Products

Opencms

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-6379 · Security Note
• https://osv.dev/vulnerability/GHSA-w62v-q77r-66cc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6379 · Vendor Advisory
• https://github.com/alkacon/opencms-core · Note
• https://github.com/alkacon/opencms-core/commit/d965c18ac6d24ad75bfea272edb8b2efd4290afa · Note
• https://twitter.com/VulmonFeeds/status/1734932202675167433 · Twitter Post
• https://twitter.com/CVEnew/status/1734894379859681612 · Twitter Post
• https://t.me/cvenotify/63832 · Telegram Post
• https://t.me/cvenotify/63426 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alkacon-software-opencms · Note