CVE-2023-42346
HighSummary
Alkacon OpenCms before version 16 allows XXE when the <!DOCTYPE> refers to an external host.
Risk Assessment
XXE attacks can lead to the disclosure of sensitive data or system compromise, posing a significant security risk to the organization.
Recommendation
It is recommended to upgrade to version 16 or later to mitigate the risk associated with this vulnerability.
Other vulnerabilities in Alkacon OpenCms
See all- CVE-2023-42344High
Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.
- CVE-2024-41446Medium
A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the image parameter under the Create/Modify article function.
Original NVD description (English source)
Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.