GHSA-g6v7-vqhx-6v6c

Source

https://github.com/advisories/GHSA-g6v7-vqhx-6v6c

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-g6v7-vqhx-6v6c/GHSA-g6v7-vqhx-6v6c.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g6v7-vqhx-6v6c

Aliases

CVE-2021-3312

Published

2021-10-12T17:23:40Z

Modified

2023-11-08T04:06:03.398566Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

XML External Entity Reference in org.opencms:opencms-core

Details

An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.

Database specific

{
    "nvd_published_at": "2021-10-08T15:15:00Z",
    "github_reviewed_at": "2021-10-11T18:55:10Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-611"
    ]
}

References

Affected packages

Maven / org.opencms:opencms-core

Package

Name: org.opencms:opencms-core; View open source insights on deps.dev
Purl: pkg:maven/org.opencms/opencms-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

11.0.0

Fixed

12.0.0

Affected versions

11.*

11.0.0

11.0.1

11.0.2

Database specific

{
    "last_known_affected_version_range": "<= 11.0.2"
}