Description

Cross-site scripting (XSS) vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image.

Remediation

References

https://github.com/alkacon/opencms-core/issues/587

https://www.exploit-db.com/exploits/44392/

Related Vulnerabilities

CVE-2018-18950 Vulnerability in maven package org.webjars.bowergithub.kindsoft:kindeditor

CVE-2017-18354 Vulnerability in npm package rendertron-middleware

CVE-2021-23387 Vulnerability in npm package trailing-slash

CVE-2021-23594 Vulnerability in npm package realms-shim

CVE-2022-24066 Vulnerability in npm package simple-git

Severity

Medium

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Tags

Exploit Third Party Advisory VDB Entry