CVE-2006-3936

描述

`system/workplace/editors/editor.jsp` in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using `index.jsp`.

如何修補 CVE-2006-3936

要修補 CVE-2006-3936,請將受影響套件升級到下列已修補版本。

• Maven/org.opencms:opencms-core—升級至 6.2.2 或更新版本

CVE-2006-3936 正在被利用嗎?

低 — EPSS 為 1.4%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 6.2.2

參考連結(6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2006-3936
• PATCHgithub.com/alkacon/opencms-core
• WEBwww.opencms.org/opencms/en/shownews.html?id=1002
• WEBexchange.xforce.ibmcloud.com/vulnerabilities/28001