CVE-2006-3936 json
Alkacon OpenCms Exposes JSP Source Code
published 2006-07-31 20 y ago modified 2026-06-16 4 mo ago also GHSA-c5vw-342h-x5rx , EUVD-2022-3514
- cvss
- 4.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 72%
- public exploits
- 0
- none known
Summary
system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using index.jsp.
Patch / fix
- maven org.opencms:opencms-core 6.2.2
Exploit prediction
1.38% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- o0o.nu http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txt referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.opencms:opencms-core | <6.2.2 |
6.2.2 |
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
secunia.com
/advisories/21193
third-party-advisory, patch, vendor-advisory
-
opencms.org
/opencms/en/shownews.html?id=1002
web, patch
-
opencms.org
/export/download/opencms/opencms_6.2.2_src.zip
patch
-
o0o.nu
/~meder/OpenCMS_multiple_vulnerabilities.txt
exploit
-
exchange.xforce.ibmcloud.com
/vulnerabilities/28001
vdb-entry, web
-
securityreason.com
/securityalert/1302
third-party-advisory
-
securityfocus.com
/archive/1/441182/100/0/threaded
mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2006-3936
advisory
-
github.com
/alkacon/opencms-core
package
-
web.archive.org
/web/20061014175017/http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txt
web
-
web.archive.org
/web/20201208142708/http://www.securityfocus.com/archive/1/441182/100/0/threaded
web
Sources
- CVE List CVE-2006-3936
- GitHub Advisory GHSA-c5vw-342h-x5rx
- NVD CVE-2006-3936
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.