CVE-2024-42699: 
Java vulnerability analysis and mitigation

Cross Site Scripting (XSS) vulnerability exists in the Create/Modify article function of Alkacon OpenCMS 17.0. The vulnerability was discovered and disclosed in April 2025, affecting Alkacon OpenCMS version 17.0. The vulnerability specifically impacts the image title sub-field within the image field functionality (NVD, CVE).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue with a CVSS v3.1 Base Score of 6.5 (Medium) and vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L. The vulnerability is tracked as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

The vulnerability allows remote attackers to inject malicious JavaScript code through the image title sub-field in the Create/Modify article function. This could potentially lead to unauthorized access to sensitive information, session hijacking, or other malicious activities typically associated with XSS attacks (NVD).

The vulnerability can be exploited remotely and requires no privileges or user interaction. However, the attack complexity is rated as high, suggesting that specific conditions need to be met for successful exploitation (NVD).