CVE-2019-13237

MEDIUM

Local file inclusion allows unauthorized access to internal resources in Alkacon OpenCms

Title source: GitHub Advisory
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2019-13237 has a selected CVSS score of 4.3 (medium); EIP currently links 1 catalogued exploit.

Description

In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Affected products and versions

1
ProductSourceVersion range

org.opencms:opencms-core

Browse Maven / org.opencms:opencms-core
GitHub AdvisoryBefore 11.0.1 · Fixed in 11.0.1affected

Proofs of concept

1

Catalogued exploits

ExploitDBAlkacon OpenCMS 10.5.x - Local File inclusionExploitDB exploitby AetsuNot analyzed1 file
ExploitDB
PoC details

References

5