OpenCms v18.0 allows hackers to inject malicious code in blog posts

Summary

An attacker can inject malicious code into OpenCms blog posts, potentially allowing them to steal user data or take control of the site. This happens when user input is not checked properly. To fix this, update to the latest version of OpenCms or apply a patch if available.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
alkacon	opencms	18.0.0	–

Original title

Stored Cross-Site Scripting (XSS) in Alkacon's OpenCms v18.0, which occurs when user input is not properly validated when sending a POST request to ‘/blog/new-article/org.opencms.ugc.CmsUgcEditServ...

Original description

Stored Cross-Site Scripting (XSS) in Alkacon's OpenCms v18.0, which occurs when user input is not properly validated when sending a POST request to ‘/blog/new-article/org.opencms.ugc.CmsUgcEditService.gwt’ using the ‘text’ parameter.

nvd CVSS3.1 5.4

nvd CVSS4.0 5.1

Vulnerability type

CWE-79 Cross-site Scripting (XSS)

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alka... Third Party Advisory