Is CVE-2023-42345 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-42345 being exploited in the wild.

How severe is CVE-2023-42345?

Medium severity, with a CVSS score of 6.1, published 8 May 2026.

Which products and versions are affected?

Alkacon OpenCms < 16.0; org.opencms:opencms-core (Maven) < 16.0, ECOSYSTEM:introduced=0,fixed=16.0.

Is there a fix for CVE-2023-42345?

Yes. org.opencms:opencms-core (Maven): upgrade to 16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-42345 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2023-42345?

Check whether you run Alkacon OpenCms or org.opencms:opencms-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-42345: A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.

Q: Which products and versions are affected?

Alkacon OpenCms < 16.0; org.opencms:opencms-core (Maven) < 16.0, ECOSYSTEM:introduced=0,fixed=16.0.

Q: Is there a fix for CVE-2023-42345?

Yes. org.opencms:opencms-core (Maven): upgrade to 16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2023-42345 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2023-42345?

Check whether you run Alkacon OpenCms or org.opencms:opencms-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-42345 · Severity: medium · CVSS 6.1 · Published 2026-05-08

Alkacon OpenCms, an open-source content management system used for building and managing websites, is vulnerable to a security flaw that could allow attackers to execute malicious scripts in a user's browser. By tricking a user into visiting a specially crafted link, an attacker could potentially steal session cookies, hijack user accounts, or deface the website as seen by the victim. This issue affects various versions of the software prior to version 16.0.

Technologies: Alkacon OpenCms, org.opencms:opencms-core (Maven). Vendors: Alkacon, Maven.

Quick answers

Is CVE-2023-42345 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-42345 being exploited in the wild.
How severe is CVE-2023-42345?: Medium severity, with a CVSS score of 6.1, published 8 May 2026.
Which products and versions are affected?: Alkacon OpenCms < 16.0; org.opencms:opencms-core (Maven) < 16.0, ECOSYSTEM:introduced=0,fixed=16.0.
Is there a fix for CVE-2023-42345?: Yes. org.opencms:opencms-core (Maven): upgrade to 16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-42345 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2023-42345?: Check whether you run Alkacon OpenCms or org.opencms:opencms-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.opencms:opencms-core (Maven): upgrade to 16.0 or later

# set org.opencms:opencms-core to 16.0 in your pom.xml or build.gradle

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in Alkacon OpenCms before version 16.0. The flaw is located within the 'updateModelGroups.jsp' file, which fails to properly neutralize user-controllable input before rendering it in the web page. An unauthenticated remote attacker can exploit this by sending a crafted URL to a victim. If the victim interacts with the link, the attacker can execute arbitrary JavaScript in the context of the victim's browser session. This can lead to unauthorized access to sensitive information, such as session tokens, or the performance of actions on behalf of the user. The vulnerability is addressed in OpenCms version 16.0.

Affected products

Alkacon OpenCms < 16.0

Identifiers

CVE-2023-42345
GHSA-2887-f3v6-6rjf

Timeline

2023-11-21: other: Vulnerability details discussed in research blog post
2026-05-08: advisory: GitHub Advisory and NVD entry published
2026-05-14: patched: GitHub Advisory updated with patch information for version 16.0

References

https://labs.watchtowr.com/xxe-you-can-depend-on-me-opencms

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.