Description

Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp) via the First Name or Last Name.

Remediation

References

https://www.openwall.com/lists/oss-security/2019/05/05/2

https://github.com/alkacon/opencms-core/issues/636

Related Vulnerabilities

CVE-2022-25878 Vulnerability in npm package protobufjs

CVE-2021-39152 Vulnerability in maven package com.thoughtworks.xstream:xstream

CVE-2022-24196 Vulnerability in maven package com.itextpdf:itext7-core

CVE-2021-44228 Vulnerability in maven package org.apache.logging.log4j:log4j-core

CVE-2022-3978 Vulnerability in npm package nodebb

Severity

High

Classification

CWE-1236 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Mailing List Exploit Third Party Advisory