CVE-2023-6380

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-6380

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-6380.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-6380

Published

2023-12-13T10:54:35.693Z

Modified

2026-07-08T06:26:46.280331799Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Open Redirect in Alkacon Software OpenCms

Details

Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially crafted URL and send it to a specific user to redirect them to a malicious site and compromise them. Exploitation of this vulnerability is possible due to the fact that there is no proper sanitization of the 'URI' parameter.

Database specific

{
    "cna_assigner": "INCIBE",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "14"
                },
                {
                    "last_affected": "14"
                },
                {
                    "introduced": "15"
                },
                {
                    "last_affected": "15"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-601"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6380.json"
}

References

Affected packages

Git / github.com/alkacon/opencms-core

Affected ranges

Type

GIT

Repo

https://github.com/alkacon/opencms-core

Events

Introduced

aa59361c26289e2d42a3fff1eb17dd95b579aa8a

Fixed

773f1d2c19a861bb0ab2bbaab97bd3bae5a76063

Database specific

{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "14.0.0"
        },
        {
            "fixed": "16.0.0"
        }
    ],
    "cpe": "cpe:2.3:a:alkacon:opencms:*:*:*:*:*:*:*:*"
}

Affected versions

Other

build_14_0_0

build_15_0_0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-6380.json"