CVE-2023-6379: Alkacon OpenCMS Mercury Template XSS Vulnerability
Summary
CVE-2023-6379: Alkacon OpenCMS XSS via Mercury template. Affects org.opencms:opencms-core versions >= 14.0.0, < 16.0.0. Fixed in 16.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Alkacon OpenCMS is a powerful open-source content management system (CMS) designed for creating and managing digital content. It is widely used for building websites and applications due to its flexibility and extensibility. The Mercury template, part of OpenCMS, is utilized for rendering web pages. However, versions 14 and 15 of this template are vulnerable to a cross-site scripting (XSS) attack, which can compromise user sessions.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the Mercury template, allowing attackers to inject malicious JavaScript code. When a victim interacts with a compromised page, the attacker can execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious activities. This XSS vulnerability is classified under CWE-79, indicating a failure to properly sanitize user input.
How To Fix
Latest published version: 22.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
16.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation and output encoding in your application to mitigate the risk of XSS attacks. Ensure that any user-generated content is properly sanitized before rendering it on the web pages.
Conclusion
The Alkacon OpenCMS vulnerability (CVE-2023-6379) presents a significant risk due to its potential for XSS attacks. Users of affected versions should prioritize updating to version 16.0.0 or later to safeguard against this vulnerability. Implementing best practices for input validation can also help mitigate risks in the interim.
See every vulnerability recorded for org.opencms:opencms-core →
FAQ
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
Versions 14 and 15 of the Mercury template in Alkacon OpenCMS are affected by this vulnerability.
An attacker can execute malicious JavaScript in the victim's browser, potentially leading to session hijacking and data theft.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Yes, you can implement input validation and output encoding to reduce the risk of XSS attacks until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.opencms:opencms-core.
