CVE-2019-13236: XSS issues in the management interface of Alkacon OpenCms
Summary
CVE-2019-13236: XSS issues in the management interface. Affects org.opencms:opencms-core versions < 11.0.1. Fixed in 11.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Alkacon OpenCms is an open-source content management system (CMS) that allows users to create, manage, and publish digital content. The CMS is built using the opencms-core package, which is a Maven-based library. This vulnerability affects versions 10.5.4 and 10.5.5 of Alkacon OpenCms. The management interface of the CMS is susceptible to multiple Reflected and Stored Cross-Site Scripting (XSS) issues.
Vulnerability Detail
The XSS vulnerabilities in the management interface of Alkacon OpenCms can be exploited by an attacker to inject malicious scripts into web pages viewed by other users. This can lead to various security risks, including the theft of sensitive information, session hijacking, and unauthorized actions on behalf of the user. The vulnerabilities are caused by insufficient input sanitization and validation in the management interface, allowing the execution of arbitrary JavaScript code.
How To Fix
Latest published version: 22.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and sanitization manually to prevent the execution of malicious scripts. This can be done by using security libraries or frameworks that provide built-in protection against XSS attacks. Here's an example of how to sanitize user input in Java using the OWASP Java Encoder library:
import org.owasp.encoder.Encode;
String userInput =
request.getParameter("input");
String sanitizedInput =
Encode.forHtml(userInput);
By encoding the user input using the Encode.forHtml() method, any HTML tags or special characters will be safely encoded and rendered as plain text in the web page.
Conclusion
The XSS vulnerabilities in the management interface of Alkacon OpenCms pose a moderate security risk and can lead to various attacks if left unpatched. It is crucial to upgrade to version 11.0.1 or later of the opencms-core package and implement proper input validation and sanitization to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.opencms:opencms-core →
FAQ
The XSS vulnerabilities in the management interface of Alkacon OpenCms can allow an attacker to execute arbitrary JavaScript code in the context of other users' sessions. This can lead to various security risks, including the theft of sensitive information, session hijacking, and unauthorized actions on behalf of the user.
No, only versions 10.5.4 and 10.5.5 of Alkacon OpenCms are affected by these XSS vulnerabilities. It is recommended to upgrade to version 11.0.1 or later to mitigate the risk.
At the time of this advisory, there are no known public exploits specifically targeting these XSS vulnerabilities in Alkacon OpenCms. However, it is important to apply the recommended fixes and best practices to ensure the security of your application.
Yes, these XSS vulnerabilities can be exploited remotely by an attacker who can trick a user with access to the management interface into visiting a specially crafted web page or clicking on a malicious link.
If you suspect that your application is affected by these XSS vulnerabilities, it is recommended to upgrade to the latest version of the opencms-core package and follow the best practices for input validation and sanitization. You can also use Vulert's playground (https://vulert.com/scanner) to check if your application is affected without any signup or installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.opencms:opencms-core.
