Read the docs
TI-2019-09921 Aliases CVE-2019-13237GHSA-36hf-6hp2-9g4c

In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local…

Priority LOW 30CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.

Why it matters now

EPSS 0.07346 94th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed org.opencms:opencms-core (Maven): 11.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.opencms:opencms-core (Maven)before 11.0.111.0.1Patch availableGHSA-36hf-6hp2-9g4c
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.opencms:opencms-core (Maven) Vendor— Affected before 11.0.1 Fixed in 11.0.1 Patch available GHSA-36hf-6hp2-9g4c

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:alkacon:opencms_apollo_template:10.5.4:*:*:*:*:*:*:*10.5.4VulnerableAlkacon
cpe:2.3:a:alkacon:opencms_apollo_template:10.5.5:*:*:*:*:*:*:*10.5.5VulnerableAlkacon
  • cpe:2.3:a:alkacon:opencms_apollo_template:10.5.4:*:*:*:*:*:*:* Versions 10.5.4 Vulnerable ·Alkacon
  • cpe:2.3:a:alkacon:opencms_apollo_template:10.5.5:*:*:*:*:*:*:* Versions 10.5.5 Vulnerable ·Alkacon

Remediation

  • Fix · GHSA-36hf-6hp2-9g4c org.opencms:opencms-core (Maven) Fixed in 11.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-13237
  2. 2026-10-03 Alias added: GHSA-36hf-6hp2-9g4c

References

Exploit 2

Patch 1

Advisory 1

Other 1

  • TI-2019-09919 In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form. CVSS 3.0MEDIUM 6.1
  • TI-2019-09918 In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine. CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences