ByteOS Network

NVD Vulnerability Details :

CVE-2019-11818

Analyzed

Source-cve@mitre.org

Published At-08 May, 2019 | 16:29

Updated At-08 May, 2019 | 18:02

Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting (XSS) in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp). This allows an attacker to insert arbitrary JavaScript as user input (First Name or Last Name), which will be executed whenever the affected snippet is loaded.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	6.1	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

alkacon>>opencms>>Versions up to 10.5.4(inclusive)

cpe:2.3:a:alkacon:opencms:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/alkacon/opencms-core/issues/635	cve@mitre.org	Exploit Third Party Advisory
https://www.openwall.com/lists/oss-security/2019/04/30/3	cve@mitre.org	Mailing List Exploit Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History