CVE-2023-42346

HIGH

Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.

StatusDeferred

설명

Alkacon OpenCms before 16 allows XXE when the refers to an external host.

Score Summary

CVSS Score: 7.5
Version: 3.1
VPI: 75
Why this VPI (explainable, experimental)
VPI breakdown
Impact 75.00
Exploitation signal(No additional exploitation signal) ×1.00
VPI 75.00
VPI formula vpi-v1
EPSS: 0.2%
(상위 14.0%)
Attack Vector: Network
Low Complexity
No Privileges
No User Interaction
Scope Unchanged
High Confidentiality Impact
No Integrity Impact
No Availability Impact

Details

CWE Weakness Classification

References (4)

https://github.com/alkacon/opencms-core

github_advisory

Impact	75.00
Exploitation signal(No additional exploitation signal)	×1.00
VPI	75.00