Lucene search

INCIBECVELIST:CVE-2021-3628

HistoryAug 27, 2021 - 12:00 a.m.

CVE-2021-3628 OpenKM Document Management Community vulnerable to Cross Site Scripting

2021-08-2700:00:00

CWE-79

INCIBE

www.cve.org

4.6 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.6%

JSON

OpenKM Community Edition in its 6.3.10 version is vulnerable to authenticated Cross-site scripting (XSS). A remote attacker could exploit this vulnerability by injecting arbitrary code via de uuid parameter.

CNA Affected

[
  {
    "product": "Document Management Community",
    "vendor": "OpenKM ",
    "versions": [
      {
        "status": "affected",
        "version": "6.3.10"
      }
    ]
  }
]

References

docs.openkm.com/kcenter/view/okm-6.3-com/migration-guide.html

github.com/openkm/document-management-system/issues/278

www.incibe-cert.es/en/early-warning/security-advisories/openkm-document-management-community-vulnerable-cross-site