CVE-2024-5520: 
Java vulnerability analysis and mitigation

Two Cross-Site Scripting (XSS) vulnerabilities have been discovered in Alkacon's OpenCMS version 16. The vulnerability was assigned CVE-2024-5520 and was disclosed on May 30, 2024. The vulnerability affects users with sufficient privileges to create and modify web pages through the admin panel (INCIBE CERT).

The vulnerability allows users with sufficient privileges to execute malicious JavaScript code by inserting code in the 'title' field. The vulnerability has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (INCIBE CERT, NVD).

A successful exploitation of this vulnerability could lead to the execution of malicious JavaScript code when a user with sufficient privileges inserts code in the 'title' field, potentially compromising the security of the web application (INCIBE CERT).

The vulnerability requires an authenticated user with sufficient privileges to create and modify web pages through the admin panel. The attack complexity is considered low, requiring network access and low privileges (INCIBE CERT).

The Cross-Site Scripting vulnerability through the 'title' field has been fixed in OpenCMS version 17. Users are advised to upgrade to this version to mitigate the vulnerability (INCIBE CERT).