Vulnerability Database

290,206

Total vulnerabilities in the database

CVE-2021-3312

An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.

CVSS v3:

  • Severity: Medium
  • Score: 6.5
  • AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v2:

  • Severity: Low
  • Score: 4
  • AV:N/AC:L/Au:S/C:P/I:N/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
alkacon / opencms 11.0.1 11.0.1.x
alkacon / opencms 11.0.2 11.0.2.x
alkacon / opencms 11.0 11.0.x
org.opencms / opencms-core 11.0.0 12.0.0