org.opencms:opencms-core (Maven)
Advisories
31
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 17.0 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.opencms</groupId><artifactId>opencms-core</artifactId><version>17.0</version></dependency>gradle
implementation("org.opencms:opencms-core:17.0")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-pj6p-9p8x-5mfc Alkacon OpenCms is vulnerable to XXE when the <!DOCTYPE> refers to an external host |
High EPSS 0.23% |
< 16.0 | 16.0 |
| GHSA-2887-f3v6-6rjf Alkacon OpenCms is vulnerable to XSS via updateModelGroups.jsp |
Medium EPSS 0.15% |
< 16.0 | 16.0 |
| GHSA-rcc6-6q2f-m2cw Alkacon OpenCms allows remote unauthenticated attackers to obtain sensitive information |
High EPSS 2.34% |
< 10.5.1 | 10.5.1 |
| GHSA-8gpv-c454-3hfc Alkacon OpenCms is vulnerable to XSS via cmis-online/type |
Medium EPSS 0.59% |
< 16.0 | 16.0 |
| GHSA-h75c-f2xx-9vxv OpenCMS Cross-Site Scripting vulnerability |
Medium EPSS 0.36% |
<= 17.0 | No fix yet |
| GHSA-7m3w-m5g3-cc88 OpenCMS cross-site scripting (XSS) vulnerability |
Medium EPSS 0.27% |
<= 17.0 | No fix yet |
| GHSA-vq95-6x79-qv8j Alkacon OpenCMS stored cross-site scripting (XSS) vulnerability |
Medium EPSS 0.27% |
<= 17.0 | No fix yet |
| GHSA-vg6x-pchq-98mg OpenCMS Cross-Site Scripting vulnerability |
Medium EPSS 0.28% |
>= 16.0, < 17.0 | 17.0 |
| GHSA-w62v-q77r-66cc Alkacon OpenCMS XSS via Mercury template |
Medium EPSS 1.75% |
>= 14.0.0, < 16.0.0 | 16.0.0 |
| GHSA-ghg2-3w9x-9599 Alkacon OpenCMS arbitrary file upload vulnerability |
Medium EPSS 0.62% |
<= 15.0 | No fix yet |
| GHSA-m44f-9jhg-59cr alkacon-OpenCMS vulnerable to stored Cross-site Scripting |
Medium EPSS 0.40% |
< 11.0.1 | 11.0.1 |
| GHSA-c8j6-gqq8-4prj Alkacon OpenCMS XSS via New User module |
Low EPSS 0.77% |
< 11.0.0 | 11.0.0 |
| GHSA-q693-v7qf-p4xj Alkacon OpenCMS CSV Injection via New User module |
High EPSS 1.00% |
< 11.0.0 | 11.0.0 |
| GHSA-4gfx-p2j4-w2vh Alkacon OpenCMS XSS via title and requestedResource parameters |
Low EPSS 1.87% |
< 8.5.2 | 8.5.2 |
| GHSA-6c8c-f2w2-jvjr Alkacon OpenCMS XSS via homelink, workplaceresource, mode and query parameters |
Low EPSS 1.89% |
< 9.5.2 | 9.5.2 |
| GHSA-4r3g-w24c-gpr6 Alkacon OpenCMS XSS via searchfilter parameter in system/workplace/admin/workplace/sessions.jsp |
Low EPSS 1.11% |
< 7.0.4 | 7.0.4 |
| GHSA-4fg8-5hwc-wg5v Alkacon OpenCMS XSS via searchfilter or listSearchFilter parameter |
Low EPSS 1.46% |
< 7.0.4 | 7.0.4 |
| GHSA-xxjj-jhgc-r68f Alkacon OpenCMS Absolute Path Traversal via pathname in filePath.0 parameter |
Medium EPSS 2.25% |
>= 7.0.3, < 7.0.5 | 7.0.5 |
| GHSA-w3v2-vfrj-j9g8 Alkacon Open CMS XSS via Logfile Viewer Settings function |
Low EPSS 1.51% |
>= 7.0.3, < 7.0.5 | 7.0.5 |
| GHSA-v965-wwrq-gxfg Alkacon OpenCMS XSS via file tree navigation in system/workplace/views/explorer/tree_files.jsp |
Low EPSS 1.47% |
< 7.0.4 | 7.0.4 |
| GHSA-c5vw-342h-x5rx Alkacon OpenCms Exposes JSP Source Code |
Medium EPSS 1.38% |
< 6.2.2 | 6.2.2 |
| GHSA-v3c3-qr6m-8m7m Alkacon OpenCMS Improper Access Control via system/workplace/views/admin/admin-main.jsp |
Medium EPSS 1.85% |
< 6.2.2 | 6.2.2 |
| GHSA-gj9c-69cm-7c37 Alkacon OpenCms XSS via unsanitized message body |
Low EPSS 1.12% |
< 6.2.2 | 6.2.2 |
| GHSA-64hc-4jx3-62jp Alkacon OpenCMS Absolute Path Traversal via pathname in filePath parameter |
Medium EPSS 1.46% |
< 6.2.2 | 6.2.2 |
| GHSA-pmfx-p95x-cg4p Alkacon OpenCms XSS via query parameter in a search action |
Low EPSS 1.36% |
>= 6.0.0, < 6.0.4 | 6.0.4 |
| GHSA-g4fc-j79q-gjrh Alkacon OpenCms XSS via username during login |
Low EPSS 1.37% |
< 6.0.3 | 6.0.3 |
| GHSA-g6v7-vqhx-6v6c XML External Entity Reference in org.opencms:opencms-core |
Medium EPSS 1.29% |
>= 11.0.0, < 12.0.0 | 12.0.0 |
| GHSA-7qqr-3pj3-q2f5 XSS issues in the management interface |
Medium EPSS 3.11% |
< 11.0.1 | 11.0.1 |
| GHSA-2p6p-v69p-9mm9 XSS in login form |
Medium EPSS 2.90% |
< 11.0.1 | 11.0.1 |
| GHSA-36hf-6hp2-9g4c Local file inclusion allows unauthorized access to internal resources in Alkacon OpenCms |
Medium EPSS 7.35% |
< 11.0.1 | 11.0.1 |
| GHSA-fxp8-7h5w-h235 XSS in search engine |
Medium EPSS 2.90% |
< 11.0.1 | 11.0.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor