Homepage
About Snyk

org.opencms:opencms-core@11.0.1 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.opencms:opencms-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Cross-site Scripting

org.opencms:opencms-core is a Java open source content management system by Alkacon Software.

Affected versions of this package are vulnerable to Cross-site Scripting due to improper neutralization of input during web page generation. An attacker can inject malicious scripts and potentially compromise the integrity of the user's session by sending a specially crafted JavaScript payload.

How to fix Cross-site Scripting?

Upgrade org.opencms:opencms-core to version 16.0 or higher.

[,16.0)
  • M
URL Redirection to Untrusted Site ('Open Redirect')

org.opencms:opencms-core is a Java open source content management system by Alkacon Software.

Affected versions of this package are vulnerable to URL Redirection to Untrusted Site ('Open Redirect') due to improper sanitization of the URI parameter. An attacker can redirect a user to a malicious site and potentially compromise their system by sending a specially crafted URL.

How to fix URL Redirection to Untrusted Site ('Open Redirect')?

Upgrade org.opencms:opencms-core to version 16.0 or higher.

[,16.0)
  • C
Arbitrary Code Execution

org.opencms:opencms-core is a Java open source content management system by Alkacon Software.

Affected versions of this package are vulnerable to Arbitrary Code Execution in the component /workplace#!explorer via uploading a crafted PNG file

How to fix Arbitrary Code Execution?

Upgrade org.opencms:opencms-core to version 17.0 or higher.

[0,17.0)
  • H
XML External Entity (XXE) Injection

org.opencms:opencms-core is a Java open source content management system by Alkacon Software.

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. It allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.

How to fix XML External Entity (XXE) Injection?

Upgrade org.opencms:opencms-core to version 12.0 or higher.

[11.0.0,12.0)
Go back to all versions of this package