CVE-2006-3936

Description

`system/workplace/editors/editor.jsp` in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using `index.jsp`.

Affected packages (1)

• Maven/org.opencms:opencms-corefrom 0, < 6.2.2

References (6)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2006-3936
• PATCHhttps://github.com/alkacon/opencms-core
• WEBhttps://exchange.xforce.ibmcloud.com/vulnerabilities/28001
• WEBhttps://web.archive.org/web/20061014175017/http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txt
• WEBhttps://web.archive.org/web/20201208142708/http://www.securityfocus.com/archive/1/441182/100/0/threaded
• WEBhttp://www.opencms.org/opencms/en/shownews.html?id=1002