CVE-2024-41447

MEDIUM5.4EPSS 0.19%

Alkacon OpenCMS stored cross-site scripting (XSS) vulnerability

Published: 4/18/2025Modified: 4/21/2025

Description

A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the author parameter under the Create/Modify article function.

Affected packages (1)

Maven/org.opencms:opencms-corefrom 0, <= 17.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-41447
PATCHhttps://github.com/alkacon/opencms-core
WEBhttps://github.com/Sidd545-cr/CVE/blob/main/CVE-2024-41447%20-%20Stored%20XSS%20in%20author%20field.pdf
WEBhttps://www.exploit-db.com/exploits/52209