OpenCms Multiple Input Validation Vulnerabilities

vendor:

OpenCms

by:

SecurityFocus

7.5

CVSS

HIGH

Multiple Input Validation Vulnerabilities

CWE

Product Name: OpenCms

Affected Version From: 7.5.2000

Affected Version To: 7.5.2000

Patch Exists: YES

Related CWE: N/A

CPE: a:opencms:opencms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

OpenCms Multiple Input Validation Vulnerabilities

OpenCms is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an authenticated attacker to obtain sensitive information, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Mitigation:

Input validation should be performed to ensure that untrusted data is not used to compromise the application.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/35979/info

OpenCms is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an authenticated attacker to obtain sensitive information, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

OpenCms 7.5.0 is affected; other versions may also be vulnerable. 

http://www.example.com/opencms/opencms/system/modules/org.opencms.workplace.help/jsptemplates/help_head.jsp?&homelink=>"&#039;><script>alert("This%20site%20has%20been%20compromised")</script>