CVE-2023-42345: Alkacon OpenCms XSS Vulnerability in updateModelGroups.jsp
Summary
CVE-2023-42345: Alkacon OpenCms is vulnerable to XSS via updateModelGroups.jsp. Affects org.opencms:opencms-core versions < 16.0. Fixed in 16.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Alkacon OpenCms is a robust open-source content management system (CMS) designed for managing and publishing digital content. It offers features such as customizable templates, user management, and a flexible architecture that supports various content types. However, prior to version 16, OpenCms is susceptible to a Cross Site Scripting (XSS) vulnerability, which can compromise the security of web applications built on this platform.
Vulnerability Detail
The vulnerability arises from inadequate input validation in the updateModelGroups.jsp file, allowing attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized actions being performed on behalf of users, data theft, or the spread of malware. The vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation, leading to XSS attacks.
How To Fix
Latest published version: 22.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
16.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input sanitization on the affected JSP file to mitigate the risk of XSS attacks. This can involve escaping user inputs and validating data before processing it.
Conclusion
In summary, the CVE-2023-42345 vulnerability in Alkacon OpenCms poses a risk of XSS attacks through the updateModelGroups.jsp file. It is crucial for users to update to version 16.0 or later to mitigate this risk. Additionally, utilizing tools like Vulert can aid in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for org.opencms:opencms-core →
FAQ
The CVSS score for this vulnerability is 6.1, indicating a moderate level of severity.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential impacts include unauthorized actions on behalf of users, data theft, and the possibility of spreading malware through compromised web pages.
Yes, a patch is available in version 16.0 of Alkacon OpenCms, which addresses this vulnerability.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file. It helps developers stay informed about vulnerabilities affecting their applications.
Related vulnerabilities
Recent vulnerabilities recorded for org.opencms:opencms-core.
