CVE-2021-3312

Description

An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the servers file system by uploading a crafted SVG document.

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.476

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-3312 are fixed in Opencms-opencms-core 12.0.0	Windows
Vulnerabilities CVE-2021-3312 are fixed in Opencms-opencms-core for Linux 12.0.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234