CVE-2023-31544: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

May 16, 2023 (updated May 17, 2023)

A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module.

References

github.com/advisories/GHSA-m44f-9jhg-59cr
github.com/alkacon/opencms-core/commit/21bfbeaf6b038e2c03bb421ce7f0933dd7a7633e
github.com/alkacon/opencms-core/issues/652
nvd.nist.gov/vuln/detail/CVE-2023-31544

Code Behaviors & Features

Detect and mitigate CVE-2023-31544 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →