GitHub Advisoryadvisory · Maven

GHSA-g6v7-vqhx-6v6c XML External Entity Reference in org.opencms:opencms-core

MEDIUM Published 2021-10-12 Modified 2021-10-18 Official page ↗
Aliases
CVE-2021-3312
Ecosystem
Maven
Packages
org.opencms:opencms-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2021-10-11

Affected packages

• Maven org.opencms:opencms-core: >= 11.0.0, < 12.0.0 → fixed in 12.0.0

Description

An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.

Related

Alias · CVE (1)

  • CVE-2021-3312 An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References