Alkacon OpenCms Cross-Site Scripting Vulnerability

A Cross-Site Scripting (XSS) vulnerability exists in Alkacon OpenCms versions prior to 10.5.1. The issue can be exploited through the 'cmis-online/type' endpoint by injecting malicious scripts that are executed in the user's browser.

Impact

Exploitation of this vulnerability allows for Cross-Site Scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a GET request to the 'cmis-online/type' endpoint with an 'id' parameter that includes a crafted payload, such as a SVG image with an 'onload' event. This will trigger the execution of the script in the browser.

Remediation

Users can upgrade to OpenCms version 10.5.1 or later to address this vulnerability.