CVE-2023-6380

MEDIUM NUCLEI

Open CMS Mercury - Open Redirect

Title source: llm

Description

Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially crafted URL and send it to a specific user to redirect them to a malicious site and compromise them. Exploitation of this vulnerability is possible due to the fact that there is no proper sanitization of the 'URI' parameter.

Nuclei Templates (1)

OpenCms 14 & 15 - Open Redirect

MEDIUMVERIFIEDby MiguelSegoviaGil

Shodan: /opencms/ || http.title:"opencms" || cpe:"cpe:2.3:a:alkacon:opencms"

FOFA: title="opencms"

References (1)

[Third Party Advisory] https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alkacon-software-opencms

Scores

CVSS v3 6.1

EPSS 0.4328

EPSS Percentile 97.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-601

Status published

Products (1)

alkacon/opencms 14.0.0 - 16.0.0

Published Dec 13, 2023

Tracked Since Feb 18, 2026