CVE-2023-6380 - Open Redirect in Alkacon Software OpenCms

Back Back to CVE browser

MEDIUM

Open Redirect in Alkacon Software OpenCms

Published Dec 13, 2023

6.1

MEDIUM

CVSS 3.1

EPSS 1.59%

Description

Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially crafted URL and send it to a specific user to redirect them to a malicious site and compromise them. Exploitation of this vulnerability is possible due to the fact that there is no proper sanitization of the 'URI' parameter.

Affected products

Vendor Alkacon Product Open CMS Default
unaffected
- Version
  14
  Status
  affected
  Constraints
  -
- Version
  15
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Alkacon

Open CMS

unaffected

Version	Status	Constraints
14	affected	-
15	affected	-

Remediation

Vendor solution

The vulnerabilities have been fixed in OpenCms version 16.

Weaknesses (1)

CWE-601

Open Redirect

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-58620
Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alkacon-software-opencms
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-58620		Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alkacon-software-opencms		Third Party Advisory