Vulnerability · Published Aug 30, 2021 · Assigned by INCIBE
CVE-2021-3628OpenKM Document Management Community vulnerable to Cross Site Scripting
Medium 4.6
In plain English
A medium-severity cross-site scripting in Document Management Community from OpenKM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Severity (CVSS 3.1)4.6Medium
Exploit odds (30 days)0.9%top 39.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
OpenKM Community Edition in its 6.3.10 version is vulnerable to authenticated Cross-site scripting (XSS). A remote attacker could exploit this vulnerability by injecting arbitrary code via de uuid parameter.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenKM | Document Management Community | 6.3.10 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
References
- https://www.incibe-cert.es/en/early-warning/security-advisories/openkm-document-management-community-vulnerable-cross-site x_refsource_CONFIRM
- https://github.com/openkm/document-management-system/issues/278 x_refsource_CONFIRM
- https://docs.openkm.com/kcenter/view/okm-6.3-com/migration-guide.html x_refsource_CONFIRM