Description
Cross-site scripting (XSS) vulnerability in search.html in Alkacon OpenCms 6.0.0, 6.0.2, and 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search action.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.opencms:opencms-core | >= 6.0.0, < 6.0.4 | 6.0.4 | GHSA-pmfx-p95x-cg4p |
References
- 25710 vdb-entry
- http://www.eazel.es/media/advisory002-OpenCms-Xml-Content-Demo-search-engine-Cross-site-scripting.html
- 1016158 vdb-entry
- ADV-2006-1931 vdb-entry
- 20251 third-party-advisory
- 20060522 OpenCms version 6.0.x Xml Content Demo search engine Cross site scripting mailing-list