CVE-2019-13237

Summary

CVE	CVE-2019-13237
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2019-08-27 12:15:00 UTC
Updated	2022-04-18 16:11:00 UTC
Description	In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.

Risk And Classification

Problem Types: CWE-22

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Alkacon	Opencms Apollo Template	10.5.4	All	All	All
Application	Alkacon	Opencms Apollo Template	10.5.5	All	All	All
Application	Alkacon	Opencms Apollo Template	10.5.4	All	All	All
Application	Alkacon	Opencms Apollo Template	10.5.5	All	All	All

References

Reference	Source	Link	Tags
OpenCMS - OpenCMS Tales	MISC	aetsu.github.io	Exploit, Third Party Advisory
Alkacon OpenCMS 10.5.x Local File Inclusion ≈ Packet Storm	MISC	packetstormsecurity.com
Commits · alkacon/opencms-core · GitHub	MISC	github.com	Patch
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

981969 Java (maven) Security Update for org.opencms:opencms-core (GHSA-36hf-6hp2-9g4c)