CVE-2024-5521: alkacon opencms

csirt@kutim:~/threat-intel/cve/CVE-2024-5521

CVSS 6.4 · Medium EPSS 0,26%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada alkacon opencms. Skor CVSS 3.1 6.4 (Medium) menurut NVD.

Deskripsi (NVD)

Two Cross-Site Scripting vulnerabilities have been discovered in Alkacon's OpenCMS affecting version 16, which could allow a user having the roles of gallery editor or VFS resource manager will have the permission to upload images in the .svg format containing JavaScript code. The code will be executed the moment another user accesses the image.

Rincian

Terbit di NVD: 30 Mei 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 6.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 0,26% peluang dieksploitasi; lebih tinggi dari 16,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
alkacon	opencms	Versi 16.0.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-stored-alkacon-opencms advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.