Moderate severityNVD Advisory· Published Oct 8, 2021· Updated Aug 3, 2024
CVE-2021-3312
CVE-2021-3312
Description
An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.opencms:opencms-coreMaven | >= 11.0.0, < 12.0.0 | 12.0.0 |
Affected products
2- Alkacon/OpenCmsdescription
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-g6v7-vqhx-6v6cghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-3312ghsaADVISORY
- github.com/alkacon/opencms-core/commit/92e035423aa6967822d343e54392d4291648c0eeghsaWEB
- github.com/alkacon/opencms-core/issues/721ghsaWEB
- github.com/alkacon/opencms-core/issues/725ghsax_refsource_MISCWEB
- github.com/alkacon/opencms-core/releasesghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.