CVE-2023-42343: Alkacon OpenCms XSS Vulnerability in cmis-online/type
Summary
CVE-2023-42343: Alkacon OpenCms is vulnerable to XSS via cmis-online/type. Affects org.opencms:opencms-core versions < 16.0. Fixed in 16.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Alkacon OpenCms is a widely used open-source content management system (CMS) that enables users to create, manage, and publish digital content. It is built on Java and is known for its flexibility and scalability, making it suitable for various applications, from small websites to large enterprise solutions. However, like many web applications, it can be susceptible to security vulnerabilities, including Cross Site Scripting (XSS), which can compromise the integrity and confidentiality of user data.
Vulnerability Detail
A Cross Site Scripting (XSS) vulnerability exists in Alkacon OpenCms versions prior to 10.5.1, specifically through the cmis-online/type endpoint. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to unauthorized actions, data theft, or session hijacking. The vulnerability is categorized under CWE-79, indicating its nature as a script injection flaw. The impact of this vulnerability can be significant, especially in environments where sensitive user data is handled.
How To Fix
Latest published version: 22.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
16.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation and output encoding on the cmis-online/type endpoint to mitigate the risk of XSS attacks. This can include sanitizing user inputs and escaping outputs to prevent script execution.
Conclusion
The XSS vulnerability in Alkacon OpenCms poses a significant risk to users and their data. It is crucial to update to version 10.5.1 or later to ensure the security of your application. Additionally, implementing workarounds can help mitigate risks until an update can be applied.
See every vulnerability recorded for org.opencms:opencms-core →
FAQ
Cross Site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising their data and security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply checking your pom.xml file, you can determine if your application is affected. Visit the Vulert playground at Vulert Scanner for a quick assessment.
Exploiting this XSS vulnerability can lead to unauthorized actions on behalf of users, data theft, session hijacking, and overall compromise of user trust in the application.
Yes, a patch is available in version 10.5.1 of Alkacon OpenCms. It is highly recommended to update to this version to mitigate the vulnerability.
The CVSS score of this vulnerability is 6.1, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for org.opencms:opencms-core.
