CVE-2023-42344

HIGH7.3EPSS 13.7%

Alkacon OpenCms allows remote unauthenticated attackers to obtain sensitive information

Published: 5/8/2026Modified: 5/14/2026

Description

Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.

Affected packages (1)

Maven/org.opencms:opencms-corefrom 0, < 10.5.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-42344
PATCHhttps://github.com/alkacon/opencms-core
WEBhttps://github.com/projectdiscovery/nuclei-templates/issues/8864
WEBhttps://labs.watchtowr.com/xxe-you-can-depend-on-me-opencms