Two Cross-Site Scripting vulnerabilities have been discovered in Alkacon's OpenCMS affecting version 16, which could allow a user with sufficient privileges to create and modify web pages through the admin panel, can execute malicious JavaScript code, after inserting code in the “title” field.
Description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Metrics
Version
Base score
Base severity
Vector
3.1
6.4
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Version:3.1
Base score:6.4
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Metrics Other Info
Impacts
CAPEC ID
Description
Solutions
The Cross-Site Scripting vulnerability through the “title” field has been fixed in version 17.
However, the vendor has stated that the Cross-Site Scripting vulnerability through images in .svg format will not be fixed because filtering the JavaScript code of .svg files could bring unwanted effects.