CVE-2024-41446

A stored cross-site scripting (XSS) vulnerability exists in Alkacon OpenCMS v17.0 [2], specifically within the Create/Modify article function. The flaw allows an attacker to inject arbitrary web scripts or HTML via a crafted payload in the image parameter [1][3].

Exploitation requires the attacker to have access to the article creation or modification interface, typically granted to authenticated users with content editor roles. The injected payload is stored on the server and executed when other users view the affected article [1].

Successful exploitation enables the attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive data [1][3].

As of the latest information, no official patch has been released for this vulnerability. Users are advised to sanitize user-supplied input, particularly the image parameter, and consider applying web application firewall rules to mitigate the risk [1][3].