CVE-2023-31544

2023-05-1621:15:09

CWE-79

[email protected]

web.nvd.nist.gov

stored cross-site scripting

arbitrary web scripts

html

crafted payload

upload image module

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

34.5%

JSON

A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module.

Affected configurations

Nvd

Node

alkaconopencmsMatch11.0-

alkaconopencmsMatch11.0beta

alkaconopencmsMatch11.0beta2

alkaconopencmsMatch11.0rc

VendorProductVersionCPE
alkaconopencms11.0cpe:2.3:a:alkacon:opencms:11.0:-:*:*:*:*:*:*
alkaconopencms11.0cpe:2.3:a:alkacon:opencms:11.0:beta:*:*:*:*:*:*
alkaconopencms11.0cpe:2.3:a:alkacon:opencms:11.0:beta2:*:*:*:*:*:*
alkaconopencms11.0cpe:2.3:a:alkacon:opencms:11.0:rc:*:*:*:*:*:*

Vendor	Product	Version	CPE
alkacon	opencms	11.0	cpe:2.3:a:alkacon:opencms:11.0:-::::::
alkacon	opencms	11.0	cpe:2.3:a:alkacon:opencms:11.0:beta::::::
alkacon	opencms	11.0	cpe:2.3:a:alkacon:opencms:11.0:beta2::::::
alkacon	opencms	11.0	cpe:2.3:a:alkacon:opencms:11.0:rc::::::