CVE-2024-41446
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the image parameter under the Create/Modify article function.
Risk Assessment
The risk involves potential execution of arbitrary scripts in users' browsers visiting the affected page, which could lead to session hijacking, redirects, or data theft.
Recommendation
Update OpenCMS to the latest patched version or apply input filtering for the image parameter in the Create/Modify article function.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the image parameter under the Create/Modify article function.