GitHub Advisoryadvisory · Maven

GHSA-rcc6-6q2f-m2cw Alkacon OpenCms allows remote unauthenticated attackers to obtain sensitive information

HIGH Published 2026-05-08 Modified 2026-05-14 Official page ↗
Aliases
CVE-2023-42344
Ecosystem
Maven
Packages
org.opencms:opencms-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-611
Reviewed
2026-05-14

Affected packages

• Maven org.opencms:opencms-core: < 10.5.1 → fixed in 10.5.1

Description

Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.

Related

Alias · CVE (1)

  • CVE-2023-42344 Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References