CVE-2023-6379

Cross-site Scripting in Alkacon Software OpenCms

MEDIUM 6.1EPSS 1.8%

Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to a victim and partially take control of their browsing session.

Affected: Alkacon · Open CMS
CVSS v3.1 NVD: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v3.1 INCIBE: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS: 1.75% chance of exploitation in the next 30 days, 78th percentile
Nuclei: medium · CWE-79
Published: 2023-12-13
Updated: 2024-10-01

Nuclei templates (1)

projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6379.yaml

Security advisories

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alkacon-softw…
advisories/GHSA-w62v-q77r-66cc

References

CVE Record
NVD entry