Skip to content
OpenAdvisories

Package · Maven

org.opencrx:opencrx-client

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.8
    CVE-2023-46502

    OpenCRX allows a remote attacker to execute arbitrary code via a crafted request

    An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory.

    org.opencrx:opencrx-client Maven
  • Medium 5.3
    CVE-2022-40084

    OpenCRX vulnerable to password enumeration via error messages in password reset

    OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which could enable an attacker to determine if a username, email or ID is valid.

    org.opencrx:opencrx-client Maven
  • Medium 6.1
    CVE-2021-25959

    OpenCRX - Reflected Cross-Site Scripting in Password Reset Functionality

    In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance.

    org.opencrx opencrx-core-config org.opencrx:opencrx-core-models org.opencrx:opencrx-client Maven