Published: 27/08/2019 Updated: 18/04/2022

CVSS v2 Base Score: 4 | Impact Score: 2.9 | Exploitability Score: 8

CVSS v3 Base Score: 4.3 | Impact Score: 1.4 | Exploitability Score: 2.8

VMScore: 405

Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N

In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an malicious user to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.

Vulnerable Product	Search on Vulmon	Subscribe to Product
alkacon opencms apollo template 10.5.4
alkacon opencms apollo template 10.5.5

# Exploit Title: Alkacon OpenCMS 105x - Multiple LFI in Alkacon OpenCms Site Management # Google Dork: N/A # Date: 18/07/2019 # Exploit Author: Aetsu # Vendor Homepage: wwwopencmsorg # Software Link: githubcom/alkacon/opencms-core # Version: 105x # Tested on: 1055 / 1054 # CVE : CVE-2019-13237 For the tests, I used the pa ...

Alkacon OpenCMS version 105x suffers from a local file inclusion vulnerability ...

CWE-22 https://github.com/alkacon/opencms-core/commits/branch_10_5_x https://aetsu.github.io/OpenCms http://packetstormsecurity.com/files/154281/Alkacon-OpenCMS-10.5.x-Local-File-Inclusion.html https://nvd.nist.gov https://www.exploit-db.com/exploits/47340

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2019-13237

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect