CVE-2013-4600

2022-10-0316:14:58

CWE-79

[email protected]

web.nvd.nist.gov

cve-2013-4600

xss

vulnerabilities

alkacon

opencms

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.7 Medium

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

77.8%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms before 8.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to system/workplace/views/admin/admin-main.jsp or the (2) requestedResource parameter to system/login/index.html.

Affected configurations

NVD

Node

alkaconopencmsRange≤8.5.1

alkaconopencmsMatch6.0.0

alkaconopencmsMatch6.0.2

alkaconopencmsMatch6.0.3

alkaconopencmsMatch6.0.4

alkaconopencmsMatch6.2

alkaconopencmsMatch6.2.1

alkaconopencmsMatch6.2.2

alkaconopencmsMatch6.2.3

alkaconopencmsMatch7.0.3

alkaconopencmsMatch7.0.4

alkaconopencmsMatch8.5

CPENameOperatorVersion
alkacon:opencmsalkacon opencmsle8.5.1
alkacon:opencmsalkacon opencmseq6.0.0
alkacon:opencmsalkacon opencmseq6.0.2
alkacon:opencmsalkacon opencmseq6.0.3
alkacon:opencmsalkacon opencmseq6.0.4
alkacon:opencmsalkacon opencmseq6.2
alkacon:opencmsalkacon opencmseq6.2.1
alkacon:opencmsalkacon opencmseq6.2.2
alkacon:opencmsalkacon opencmseq6.2.3
alkacon:opencmsalkacon opencmseq7.0.3

CPE	Name	Operator	Version
alkacon:opencms	alkacon opencms	le	8.5.1
alkacon:opencms	alkacon opencms	eq	6.0.0
alkacon:opencms	alkacon opencms	eq	6.0.2
alkacon:opencms	alkacon opencms	eq	6.0.3
alkacon:opencms	alkacon opencms	eq	6.0.4
alkacon:opencms	alkacon opencms	eq	6.2
alkacon:opencms	alkacon opencms	eq	6.2.1
alkacon:opencms	alkacon opencms	eq	6.2.2
alkacon:opencms	alkacon opencms	eq	6.2.3
alkacon:opencms	alkacon opencms	eq	7.0.3