Executive brief
Alkacon OpenCms, an open-source content management system used for building and managing websites, is vulnerable to a security flaw that could allow attackers to execute malicious scripts in a user's browser. By tricking a user into visiting a specially crafted link, an attacker could potentially steal session cookies, hijack user accounts, or deface the website as seen by the victim. This issue affects various versions of the software prior to version 16.0.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Alkacon OpenCms before version 16.0. The flaw is located within the 'updateModelGroups.jsp' file, which fails to properly neutralize user-controllable input before rendering it in the web page. An unauthenticated remote attacker can exploit this by sending a crafted URL to a victim. If the victim interacts with the link, the attacker can execute arbitrary JavaScript in the context of the victim's browser session. This can lead to unauthorized access to sensitive information, such as session tokens, or the performance of actions on behalf of the user. The vulnerability is addressed in OpenCms version 16.0.
Affected products
- Alkacon OpenCms < 16.0
Timeline
- 2023-11-21: other: Vulnerability details discussed in research blog post
- 2026-05-08: advisory: GitHub Advisory and NVD entry published
- 2026-05-14: patched: GitHub Advisory updated with patch information for version 16.0