CVE-2019-13237 - In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp

Back Back to CVE browser

MEDIUM

In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp

Published Aug 27, 2019

4.3

MEDIUM

CVSS 3.1

EPSS 7.35%

Description

In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-22

Path Traversal

References (5)

http://packetstormsecurity.com/files/154281/Alkacon-OpenCMS-10.5.x-Local-File-Inclusion.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://aetsu.github.io/OpenCms
x_refsource_MISCExploitThird Party Advisory
https://github.com/advisories/GHSA-36hf-6hp2-9g4c
Advisory
https://github.com/alkacon/opencms-core/commits/branch_10_5_x
x_refsource_MISCPatch
https://nvd.nist.gov/vuln/detail/CVE-2019-13237

Link	Providers	Tags
http://packetstormsecurity.com/files/154281/Alkacon-OpenCMS-10.5.x-Local-File-Inclusion.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://aetsu.github.io/OpenCms		x_refsource_MISCExploitThird Party Advisory
https://github.com/advisories/GHSA-36hf-6hp2-9g4c		Advisory
https://github.com/alkacon/opencms-core/commits/branch_10_5_x		x_refsource_MISCPatch
https://nvd.nist.gov/vuln/detail/CVE-2019-13237