CVE-2006-3935: Alkacon OpenCMS Improper Access Control via system/workplace/views/admin/admin-main.jsp
(updated )
system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which allows remote authenticated users to (1) send broadcast messages to all users (/workplace/broadcast), (2) list all users (/accounts/users), (3) add webusers (/accounts/webusers/new), (4) upload database import and export files (/database/importhttp), (5) upload arbitrary program modules (/modules/modules_import), and (6) read the log file (/workplace/logfileview) by setting the appropriate value for the path parameter in a direct request to admin-main.jsp.
References
- exchange.xforce.ibmcloud.com/vulnerabilities/27996
- exchange.xforce.ibmcloud.com/vulnerabilities/28003
- exchange.xforce.ibmcloud.com/vulnerabilities/28010
- exchange.xforce.ibmcloud.com/vulnerabilities/28026
- exchange.xforce.ibmcloud.com/vulnerabilities/28031
- exchange.xforce.ibmcloud.com/vulnerabilities/28036
- github.com/advisories/GHSA-v3c3-qr6m-8m7m
- github.com/alkacon/opencms-core
- github.com/alkacon/opencms-core/commit/8f1c04c5a16fe8d0bdbd13b65bf2a7b5cf100ff9
- nvd.nist.gov/vuln/detail/CVE-2006-3935
Code Behaviors & Features
Detect and mitigate CVE-2006-3935 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →