CVE-2023-42344: Alkacon OpenCms Remote Information Disclosure via XXE Attack
Summary
CVE-2023-42344: Alkacon OpenCms allows remote unauthenticated attackers to obtain sensitive information. Affects org.opencms:opencms-core versions < 10.5.1. Fixed in 10.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Alkacon OpenCms is a robust open-source content management system (CMS) designed for building and managing websites and web applications. It offers features such as customizable templates, user management, and content versioning. However, prior to version 10.5.1, OpenCms is vulnerable to a specific attack that can lead to unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability identified as CVE-2023-42344 allows remote unauthenticated attackers to exploit an XML External Entity (XXE) attack through the cmis-online/query endpoint on a Chemistry servlet. This can lead to the disclosure of sensitive information stored on the server, potentially compromising user data and application integrity. The issue arises from improper handling of XML input, which can be manipulated to access unintended files or data.
How To Fix
Latest published version: 22.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.5.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation and sanitization for XML data to mitigate the risk of XXE attacks. Additionally, disabling external entity processing in your XML parser can help prevent exploitation.
Conclusion
CVE-2023-42344 is a significant vulnerability affecting Alkacon OpenCms, allowing remote attackers to exploit XXE attacks for information disclosure. It is crucial for users to update to version 10.5.1 or later to safeguard their applications against potential threats.
See every vulnerability recorded for org.opencms:opencms-core →
FAQ
CVE-2023-42344 is a vulnerability in Alkacon OpenCms that allows remote attackers to exploit an XXE attack, leading to potential information disclosure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
An XML External Entity (XXE) attack is a type of security vulnerability that allows an attacker to interfere with the processing of XML data, potentially leading to unauthorized access to sensitive files.
Exploitation of this vulnerability can lead to unauthorized access to sensitive information, which may compromise user data and the overall security of the application.
Yes, the vulnerability is fixed in version 10.5.1 of OpenCms. It is recommended to update to this version or later to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for org.opencms:opencms-core.
