CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
9.0%
Two Cross-Site Scripting vulnerabilities have been discovered in Alkaconβs OpenCMS affecting version 16, which could allow a userΒ having the roles of gallery editor or VFS resource manager will have the permission to upload images in the .svg format containing JavaScript code. The code will be executed the moment another user accesses the image.
[
{
"defaultStatus": "unaffected",
"product": "OpenCMS",
"vendor": "Alkacon",
"versions": [
{
"status": "affected",
"version": "16"
}
]
}
]