Homepage
About Snyk

org.opencms%3Aopencms-core@9.0.1 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.opencms%3Aopencms-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Cross-site Scripting

org.opencms:opencms-core is a Java open source content management system by Alkacon Software.

Affected versions of this package are vulnerable to Cross-site Scripting due to improper neutralization of input during web page generation. An attacker can inject malicious scripts and potentially compromise the integrity of the user's session by sending a specially crafted JavaScript payload.

How to fix Cross-site Scripting?

Upgrade org.opencms:opencms-core to version 16.0 or higher.

[,16.0)
  • M
URL Redirection to Untrusted Site ('Open Redirect')

org.opencms:opencms-core is a Java open source content management system by Alkacon Software.

Affected versions of this package are vulnerable to URL Redirection to Untrusted Site ('Open Redirect') due to improper sanitization of the URI parameter. An attacker can redirect a user to a malicious site and potentially compromise their system by sending a specially crafted URL.

How to fix URL Redirection to Untrusted Site ('Open Redirect')?

Upgrade org.opencms:opencms-core to version 16.0 or higher.

[,16.0)
  • C
Arbitrary Code Execution

org.opencms:opencms-core is a Java open source content management system by Alkacon Software.

Affected versions of this package are vulnerable to Arbitrary Code Execution in the component /workplace#!explorer via uploading a crafted PNG file

How to fix Arbitrary Code Execution?

Upgrade org.opencms:opencms-core to version 17.0 or higher.

[0,17.0)
  • M
Cross-site Scripting (XSS)

org.opencms:opencms-core is a Java open source content management system by Alkacon Software.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the "Title" field in the "Upload Image" module.

How to fix Cross-site Scripting (XSS)?

Upgrade org.opencms:opencms-core to version 11.0.1 or higher.

[,11.0.1)
  • M
Cross-site Scripting (XSS)

org.opencms:opencms-core is a Java open source content management system by Alkacon Software.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the Login form.

How to fix Cross-site Scripting (XSS)?

Upgrade org.opencms:opencms-core to version 11.0.1 or higher.

[,11.0.1)
  • M
Cross-site Scripting (XSS)

org.opencms:opencms-core is a Java open source content management system by Alkacon Software.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the search engine.

How to fix Cross-site Scripting (XSS)?

Upgrade org.opencms:opencms-core to version 11.0.1 or higher.

[,11.0.1)
  • H
Cross-site Scripting (XSS)

org.opencms:opencms-core is a Java open source content management system by Alkacon Software.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). None

How to fix Cross-site Scripting (XSS)?

Upgrade org.opencms:opencms-core to version 11.0.0 or higher.

[,11.0.0)
  • M
Local File Inclusion

org.opencms:opencms-core is a Java open source content management system by Alkacon Software.

Affected versions of this package are vulnerable to Local File Inclusion. None

How to fix Local File Inclusion?

Upgrade org.opencms:opencms-core to version 11.0.0 or higher.

[,11.0.0)
  • H
Cross-site Request Forgery (CSRF)

org.opencms:opencms-core is a Java open source content management system by Alkacon Software.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) in system/workplace/admin/accounts/user_role.jsp. It allows remote attackers to hijack the authentication of administrative users for requests that perform privilege escalation.

How to fix Cross-site Request Forgery (CSRF)?

Upgrade org.opencms:opencms-core to version 11.0.0 or higher.

[0,11.0.0)
Go back to all versions of this package