Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTM2aGYtNmhwMi05ZzRj

Local file inclusion allows unauthorized access to internal resources in Alkacon OpenCms

In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.

Permalink: https://github.com/advisories/GHSA-36hf-6hp2-9g4c
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTM2aGYtNmhwMi05ZzRj
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 5 years ago
Updated: almost 2 years ago

CVSS Score: 4.3
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Identifiers: GHSA-36hf-6hp2-9g4c, CVE-2019-13237
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-13237
• https://aetsu.github.io/OpenCms
• https://github.com/alkacon/opencms-core/commits/branch_10_5_x
• http://packetstormsecurity.com/files/154281/Alkacon-OpenCMS-10.5.x-Local-File-Inclusion.html
• https://github.com/advisories/GHSA-36hf-6hp2-9g4c

Repository: https://github.com/alkacon/opencms-core
Blast Radius: 5.8

Affected Packages