CVE-2019-13234: XSS in search engine in Alkacon OpenCms Apollo Template
Summary
CVE-2019-13234: XSS in search engine. Affects org.opencms:opencms-core versions < 11.0.1. Fixed in 11.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Alkacon OpenCms Apollo Template is a popular open-source template used for website development. It provides various features and functionalities for creating dynamic and interactive websites. However, versions 10.5.4 and 10.5.5 of the template are vulnerable to a cross-site scripting (XSS) attack in the search engine component.
Vulnerability Detail
The XSS vulnerability in the search engine of Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5 allows an attacker to inject malicious scripts into the search engine, which can then be executed by unsuspecting users. This can lead to various security risks, such as stealing sensitive information, session hijacking, or performing unauthorized actions on behalf of the user. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Latest published version: 22.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the search engine functionality or implement input validation and output encoding to prevent the execution of malicious scripts. Here is an example of input validation using Java Servlets:
String userInput = request.getParameter("search");
String sanitizedInput = userInput.replaceAll("<", "<").replaceAll(">", ">");
This code snippet sanitizes the user input by replacing the '<' and '>' characters with their corresponding HTML entities, preventing the execution of any embedded scripts.
Conclusion
The Alkacon OpenCms Apollo Template versions 10.5.4 and 10.5.5 are vulnerable to an XSS attack in the search engine component. To mitigate this vulnerability, it is recommended to upgrade to version 11.0.1 or later. If immediate upgrade is not possible, disabling the search engine functionality or implementing input validation and output encoding can serve as temporary workarounds. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.opencms:opencms-core →
FAQ
The vulnerability allows an attacker to inject malicious scripts into the search engine, potentially leading to the theft of sensitive information, session hijacking, or unauthorized actions on behalf of the user.
No, only versions 10.5.4 and 10.5.5 of the template are vulnerable to this XSS attack in the search engine component.
Yes, upgrading to version 11.0.1 or later of the Alkacon OpenCms Apollo Template will fix the XSS vulnerability in the search engine component.
Yes, disabling the search engine functionality can mitigate the risk of exploitation until the template is upgraded to a fixed version.
Yes, implementing proper input validation and output encoding can help prevent the execution of malicious scripts and mitigate the XSS vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.opencms:opencms-core.
