CVE-2024-41446: OpenCMS Core Package Stored XSS Vulnerability
Summary
CVE-2024-41446: OpenCMS cross-site scripting (XSS) vulnerability. Affects org.opencms:opencms-core versions < 17.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Alkacon OpenCMS is a widely used open-source content management system (CMS) that allows users to create, manage, and publish digital content. It is built on Java and utilizes a modular architecture, making it flexible and extensible for various web applications. The OpenCMS Core package is essential for its functionality, providing core features and services. However, version 17.0 has been identified to contain a stored cross-site scripting (XSS) vulnerability that can be exploited by attackers.
Vulnerability Detail
The stored XSS vulnerability in Alkacon OpenCMS v17.0 allows attackers to inject malicious scripts through the image parameter in the Create/Modify article function. This can lead to the execution of arbitrary web scripts or HTML in the context of users who access the affected articles. The vulnerability arises from insufficient input validation and sanitization, enabling attackers to manipulate the content displayed to users. If exploited, this could result in data theft, session hijacking, or defacement of the website, posing significant risks to both users and the integrity of the web application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement input validation and sanitization on the image parameter to mitigate the risk of XSS attacks. This can be done by escaping special characters and ensuring that only safe content is processed. However, this is not a permanent solution and should be followed by an upgrade to the patched version.
Conclusion
The stored XSS vulnerability in Alkacon OpenCMS v17.0 poses significant risks to users and the application itself. It is crucial for users to update to the patched version 17.1 to protect against potential exploits. Additionally, implementing input validation can serve as a temporary measure until the upgrade is completed.
See every vulnerability recorded for org.opencms:opencms-core →
FAQ
The vulnerability is a stored cross-site scripting (XSS) issue that allows attackers to inject malicious scripts into the OpenCMS application.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can also use the Vulert playground to analyze your pom.xml without signing up.
If exploited, this vulnerability can lead to data theft, session hijacking, and defacement of the website, compromising user security and application integrity.
Yes, a patch is available in version 17.1 of the OpenCMS Core package. Users should upgrade to this version to mitigate the vulnerability.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.opencms:opencms-core.
