alkacon/opencms-core · Security
Alkacon OpenCMS CSV Injection via New User module
- GHSA ID
- GHSA-q693-v7qf-p4xj
- CVE ID
- CVE-2019-11819
- Severity
- high
- Published
- Updated
- CVSS
- 7.8 · CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v3
- 7.8 · CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp) via the First Name or Last Name.
CWEs
- CWE-1236 · Improper Neutralization of Formula Elements in a CSV File