Quick answers
- Is CVE-2023-42343 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2023-42343 being exploited in the wild.
- How severe is CVE-2023-42343?
- Medium severity, with a CVSS score of 6.1, published 8 May 2026.
- Which products and versions are affected?
- org.opencms:opencms-core (Maven) < 16.0, ECOSYSTEM:introduced=0,fixed=16.0.
- Is there a fix for CVE-2023-42343?
- Yes. org.opencms:opencms-core (Maven): upgrade to 16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2023-42343 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2023-42343?
- Check whether you run org.opencms:opencms-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- org.opencms:opencms-core (Maven): upgrade to 16.0 or later
# set org.opencms:opencms-core to 16.0 in your pom.xml or build.gradle
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in Alkacon OpenCms versions prior to 16.0. The vulnerability is located in the 'cmis-online/type' endpoint, where user-supplied input is improperly neutralized before being rendered in the server's response. An unauthenticated remote attacker can exploit this by persuading a user to visit a malicious URL. Successful exploitation allows the execution of arbitrary JavaScript in the victim's browser, potentially leading to session hijacking (via cookie theft) or unauthorized actions within the CMS. The issue was addressed in version 16.0.
Affected products
- Alkacon OpenCms < 16.0
Identifiers
- CVE-2023-42343
- GHSA-8gpv-c454-3hfc
Timeline
- 2023-11-21: other: Initial research published by watchTowr Labs
- 2026-05-08: disclosed: CVE-2023-42343 published
- 2026-05-08: advisory: GitHub Advisory published