PT-2023-7058 · Opencms · Opencms

Published 2023-08-07 · Updated 2026-05-10 · CVE-2023-42344

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Alkacon OpenCms versions prior to 10.5.1

Description Remote unauthenticated attackers can obtain sensitive information or execute arbitrary code by sending a specially crafted POST request. This is possible due to improper restriction of XML references to external objects, leading to an XML External Entity (XXE) attack—a technique where an application processes external entities within an XML document—targeting the 'cmis-online/query' endpoint on a Chemistry servlet.

Recommendations Update to version 10.5.1 or later.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2023-08080

CVE-2023-42344

GHSA-RCC6-6Q2F-M2CW

Affected Products

Opencms

References · 18

• 🔥 https://github.com/projectdiscovery/nuclei-templates/issues/8864 · Exploit
• https://osv.dev/vulnerability/GHSA-rcc6-6q2f-m2cw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42344 · Security Note
• https://bdu.fstec.ru/vul/2023-08080 · Security Note
• https://github.com/alkacon/opencms-core · Note
• https://labs.watchtowr.com/xxe-you-can-depend-on-me-opencms · Note
• https://t.me/rnetsec/19638 · Telegram Post
• https://twitter.com/security_oso/status/1735336094609047798 · Twitter Post
• https://t.me/defcon_news/119912 · Telegram Post
• https://t.me/thebugbountyhunter/8041 · Telegram Post
• https://twitter.com/NaveedHamid/status/1733811800607437242 · Twitter Post
• https://t.me/secharvester/14735 · Telegram Post
• https://twitter.com/fletch_ai/status/1733684716140654761 · Twitter Post
• https://twitter.com/techadversary/status/1732594041852965101 · Twitter Post
• https://t.me/secharvester/14739 · Telegram Post