CVE-2023-42344 Scanner

OpenCMS is a professional, open-source content management system widely used by enterprises and organizations to manage and publish web content. It provides a robust platform for creating, editing, and managing websites, with features like workflow management, template engines, and multi-language support. System administrators and developers rely on OpenCMS for its flexibility and scalability in handling complex content structures.

XML External Entity (XXE) vulnerability in OpenCMS arises when the application processes XML input from untrusted sources without proper validation. This flaw occurs because the XML parser is configured to resolve external entities, allowing attackers to inject malicious XML content. The vulnerability is rooted in the failure to disable external entity processing in the underlying XML library, making it a classic XXE issue.

Specifically, the vulnerability affects the XML parsing functionality in OpenCMS versions prior to 10.5.1. Attackers can exploit this by sending crafted XML payloads to endpoints that handle XML data, such as import or export functions. The vulnerable parameter is typically the XML body itself, where external entities can be defined and referenced to access local files or internal resources.

If exploited, this XXE vulnerability can lead to severe consequences, including unauthorized access to sensitive files like configuration files or user data, server-side request forgery (SSRF) enabling attacks on internal systems, and potential denial of service. The CVSS score of 8.2 highlights the high risk, as attackers can compromise the confidentiality and integrity of the OpenCMS server and its data.