CVE-2023-42346: Alkacon OpenCms XXE Vulnerability in org.opencms:opencms-core
Summary
CVE-2023-42346: Alkacon OpenCms is vulnerable to XXE when the refers to an external host. Affects org.opencms:opencms-core versions < 16.0. Fixed in 16.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Alkacon OpenCms is a robust open-source content management system (CMS) designed for building and managing websites. It provides a wide range of features including templating, version control, and user management, making it a popular choice for developers and businesses. However, prior to version 16, OpenCms is susceptible to XML External Entity (XXE) attacks when the <!DOCTYPE> declaration references an external host, potentially compromising the integrity and confidentiality of the application.
Vulnerability Detail
The vulnerability arises from the handling of XML input in Alkacon OpenCms versions before 16. When an XML document is processed that includes a <!DOCTYPE> declaration pointing to an external entity, it can lead to the exposure of sensitive data or even allow an attacker to execute arbitrary code. This can have severe implications, including data breaches and unauthorized access to the system.
How To Fix
Latest published version: 22.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
16.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to disable the processing of external entities in the XML parser. This can be done by configuring the XML parser settings in your application code. For example:
import javax.xml.parsers.DocumentBuilderFactory;
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
This will help mitigate the risk of XXE attacks until the package can be updated.
Conclusion
The Alkacon OpenCms XXE vulnerability (CVE-2023-42346) poses significant risks to applications using versions prior to 16.0. It is crucial to update to the latest version to mitigate these risks and ensure the security of your application.
See every vulnerability recorded for org.opencms:opencms-core →
FAQ
XXE stands for XML External Entity, a type of attack that exploits vulnerabilities in XML parsers to access sensitive data or execute malicious code.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your pom.xml without needing to sign up.
The risks include data breaches, unauthorized access to sensitive information, and potential remote code execution, which can compromise the entire system.
Yes, the vulnerability has been patched in version 16.0 of the org.opencms:opencms-core package. It is recommended to upgrade to this version.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.opencms:opencms-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
