alkacon/opencms-core · Security
Local file inclusion allows unauthorized access to internal resources in Alkacon OpenCms
- GHSA ID
- GHSA-36hf-6hp2-9g4c
- CVE ID
- CVE-2019-13237
- Severity
- medium
- Published
- Updated
- CVSS
- 4.3 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS v3
- 4.3 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.
CWEs
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor