UNKNOWN Maven
Alkacon OpenCMS XSS via New User module
GHSA-c8j6-gqq8-4prj · CVE-2019-11818
Published · Modified
Description
Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting (XSS) in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp). This allows an attacker to insert arbitrary JavaScript as user input (First Name or Last Name), which will be executed whenever the affected snippet is loaded.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2019-11818
- WEB https://github.com/alkacon/opencms-core/issues/635
- WEB https://github.com/alkacon/opencms-core/commit/b20c293aac133e110a053f1e6665a9ae82cfdeb3
- WEB https://github.com/alkacon/opencms-core
- WEB https://www.openwall.com/lists/oss-security/2019/04/30/3
Ready to move
Start Securing
Free, no credit card | First findings in minutes