VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published May 30, 2024· Updated Aug 1, 2024

Cross-Site Scripting stored in Alkacon OpenCMS

CVE-2024-5520

Description

Two Cross-Site Scripting vulnerabilities have been discovered in Alkacon's OpenCMS affecting version 16, which could allow a user with sufficient privileges to create and modify web pages through the admin panel, can execute malicious JavaScript code, after inserting code in the “title” field.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.opencms:opencms-coreMaven
>= 16.0, < 17.017.0

Affected products

1

Patches

1
b05a5aca0f2b

Fixed XSS issue in site management.

https://github.com/alkacon/opencms-coregWestenbergerApr 2, 2024via ghsa
commit
2 files changed · +6 −4
  • src/org/opencms/ui/apps/sitemanager/CmsCreateSiteThread.java+3 −2 modified
    @@ -41,6 +41,7 @@
 import org.opencms.file.types.CmsResourceTypeFolderSubSitemap;
 import org.opencms.file.types.CmsResourceTypeImage;
 import org.opencms.file.types.I_CmsResourceType;
+import org.opencms.i18n.CmsEncoder;
 import org.opencms.loader.CmsLoaderException;
 import org.opencms.lock.CmsLockException;
 import org.opencms.main.CmsException;
@@ -193,11 +194,11 @@ public void run() {
 
             if (m_oldSite == null) {
                 getReport().println(
-                    Messages.get().container(Messages.RPT_SITE_START_NEW_1, m_site.getTitle()),
+                    Messages.get().container(Messages.RPT_SITE_START_NEW_1, CmsEncoder.escapeXml(m_site.getTitle())),
                     I_CmsReport.FORMAT_HEADLINE);
             } else {
                 getReport().println(
-                    Messages.get().container(Messages.RPT_SITE_START_EDIT_1, m_site.getTitle()),
+                    Messages.get().container(Messages.RPT_SITE_START_EDIT_1, CmsEncoder.escapeXml(m_site.getTitle())),
                     I_CmsReport.FORMAT_HEADLINE);
             }
             CmsResource siteRootResource = null;
  • src/org/opencms/ui/apps/sitemanager/CmsDeleteSiteDialog.java+3 −2 modified
    @@ -28,6 +28,7 @@
 package org.opencms.ui.apps.sitemanager;
 
 import org.opencms.file.CmsResource;
+import org.opencms.i18n.CmsEncoder;
 import org.opencms.lock.CmsLockException;
 import org.opencms.main.CmsException;
 import org.opencms.main.CmsLog;
@@ -134,14 +135,14 @@ protected VerticalLayout getContent() {
         if (m_sitesToDelete.size() == 1) {
             message = CmsVaadinUtils.getMessageText(
                 Messages.GUI_SITE_CONFIRM_DELETE_SITE_1,
-                m_sitesToDelete.get(0).getTitle());
+                CmsEncoder.escapeXml(m_sitesToDelete.get(0).getTitle()));
         } else {
             message = "";
             for (CmsSite site : m_sitesToDelete) {
                 if (message.length() > 0) {
                     message += ", ";
                 }
-                message += site.getTitle();
+                message += CmsEncoder.escapeXml(site.getTitle());
             }
             message = CmsVaadinUtils.getMessageText(Messages.GUI_SITE_CONFIRM_DELETE_SITES_1, message);
         }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.