# CVE-2023-42345: A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.

Source: https://junglewise.ai/threats/cve-2023-42345-alkacon-opencms-xss-in-updatemodelgroups-jsp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2023-42345 · Severity: medium · CVSS 6.1 · Published 2026-05-08

Alkacon OpenCms, an open-source content management system used for building and managing websites, is vulnerable to a security flaw that could allow attackers to execute malicious scripts in a user's browser. By tricking a user into visiting a specially crafted link, an attacker could potentially steal session cookies, hijack user accounts, or deface the website as seen by the victim. This issue affects various versions of the software prior to version 16.0.

Technologies: [Alkacon OpenCms](https://junglewise.ai/threats/technologies/opencms), [org.opencms:opencms-core (Maven)](https://junglewise.ai/threats/technologies/org-opencms-opencms-core). Vendors: [Alkacon](https://junglewise.ai/threats/vendors/alkacon), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2023-42345 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-42345 being exploited in the wild.

**How severe is CVE-2023-42345?** Medium severity, with a CVSS score of 6.1, published 8 May 2026.

**Which products and versions are affected?** Alkacon OpenCms < 16.0; org.opencms:opencms-core (Maven) < 16.0, ECOSYSTEM:introduced=0,fixed=16.0.

**Is there a fix for CVE-2023-42345?** Yes. org.opencms:opencms-core (Maven): upgrade to 16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-42345 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2023-42345?** Check whether you run Alkacon OpenCms or org.opencms:opencms-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.opencms:opencms-core (Maven): upgrade to 16.0 or later

  ```sh
  # set org.opencms:opencms-core to 16.0 in your pom.xml or build.gradle
  ```


## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in Alkacon OpenCms before version 16.0. The flaw is located within the 'updateModelGroups.jsp' file, which fails to properly neutralize user-controllable input before rendering it in the web page. An unauthenticated remote attacker can exploit this by sending a crafted URL to a victim. If the victim interacts with the link, the attacker can execute arbitrary JavaScript in the context of the victim's browser session. This can lead to unauthorized access to sensitive information, such as session tokens, or the performance of actions on behalf of the user. The vulnerability is addressed in OpenCms version 16.0.

## Affected products

- Alkacon OpenCms < 16.0

## Identifiers

- CVE-2023-42345
- GHSA-2887-f3v6-6rjf

## Timeline

- 2023-11-21: other: Vulnerability details discussed in research blog post
- 2026-05-08: advisory: GitHub Advisory and NVD entry published
- 2026-05-14: patched: GitHub Advisory updated with patch information for version 16.0

## References

- [https://labs.watchtowr.com/xxe-you-can-depend-on-me-opencms](https://labs.watchtowr.com/xxe-you-can-depend-on-me-opencms)

## Related threats

- [Alkacon OpenCms XXE in CMIS AtomPub servlet](https://junglewise.ai/threats/cve-2023-42346-alkacon-opencms-xxe-in-cmis-atompub-servlet)
- [Alkacon OpenCms XXE in Chemistry servlet](https://junglewise.ai/threats/cve-2023-42344-alkacon-opencms-xxe-in-chemistry-servlet)
- [A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.](https://junglewise.ai/threats/cve-2023-42343-alkacon-opencms-xss-in-cmis-online-type)
- [OpenCMS Cross-Site Scripting vulnerability](https://junglewise.ai/threats/cve-2024-42699-opencms-cross-site-scripting-vulnerability)
- [OpenCMS cross-site scripting (XSS) vulnerability](https://junglewise.ai/threats/cve-2024-41446-opencms-cross-site-scripting-xss-vulnerability)