CVE-2021-3628: OpenKM Document Management Community vulnerable to Cross Site Scripting

Published Aug 30, 2021

Updated

OpenKM Community Edition in its 6.3.10 version is vulnerable to authenticated Cross-site scripting (XSS). A remote attacker could exploit this vulnerability by injecting arbitrary code via de uuid parameter.

Affected Software

1 affected component

OpenKM OpenKM=6.3.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenKM Community Edition to a version that resolves this vulnerability.
Fixed in 6.3.11

Event History

Aug 30, 2021

CVE Published

via MITRE·05:06 PM

Data Sourced

via MITRE·05:06 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·06:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2021-3628?

CVE-2021-3628 is classified as a medium severity vulnerability due to its potential for authenticated cross-site scripting attacks.

How do I fix CVE-2021-3628?

To fix CVE-2021-3628, you should update to a patched version of OpenKM that addresses this XSS vulnerability.

Who is affected by CVE-2021-3628?

CVE-2021-3628 affects users of OpenKM Community Edition version 6.3.10.

What type of vulnerability is CVE-2021-3628?

CVE-2021-3628 is an authenticated cross-site scripting (XSS) vulnerability.

Can CVE-2021-3628 be exploited remotely?

Yes, a remote attacker can exploit CVE-2021-3628 by injecting arbitrary code via the uuid parameter.