Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp) via the First Name or Last Name.
References:GSA_kwCzR0hTQS1xNjkzLXY3cWYtcDR4as4AAgp8
Alkacon OpenCMS CSV Injection via New User module
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| maven:org.opencms:opencms-core | < 11.0.0 | 11.0.0 | |
Affected Version RangesAll affected versions8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.5.0, 8.5.1, 8.5.2, 9.0.0, 9.0.1, 9.5.0, 9.5.1, 9.5.2, 9.5.3, 10.0.0, 10.0.1, 10.5.0, 10.5.1, 10.5.2, 10.5.3, 10.5.4 All unaffected versions11.0.0, 11.0.1, 11.0.2 |
|||