Alkacon OpenCMS XSS via file tree navigation in system/workplace/views/explorer/tree_files.jsp

GHSA-v965-wwrq-gxfg · CVE-2008-1045

Published May 1, 2022 · Modified Jun 20, 2025

Description

Cross-site scripting (XSS) vulnerability in the file tree navigation function in system/workplace/views/explorer/tree_files.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the resource parameter.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2008-1045
WEB https://github.com/alkacon/opencms-core/commit/49c5beded65bf0232cab61b1299b85dee9ae2014
PACKAGE https://github.com/alkacon/opencms-core
WEB http://securityreason.com/securityalert/3702

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes