Skip to content
Fencer Vulns
medium 6.5

CVE-2006-3935 json

Alkacon OpenCMS Improper Access Control via system/workplace/views/admin/admin-main.jsp

published 2006-07-31 20 y ago modified 2026-06-16 4 mo ago also GHSA-v3c3-qr6m-8m7m , EUVD-2006-3929

cvss
6.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 79%
public exploits
0
none known

Summary

system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which allows remote authenticated users to (1) send broadcast messages to all users (/workplace/broadcast), (2) list all users (/accounts/users), (3) add webusers (/accounts/webusers/new), (4) upload database import and export files (/database/importhttp), (5) upload arbitrary program modules (/modules/modules_import), and (6) read the log file (/workplace/logfileview) by setting the appropriate value for the path parameter in a direct request to admin-main.jsp.

Patch / fix

  • maven org.opencms:opencms-core 6.2.2

Exploit prediction

1.85% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected packages

ecosystem package affected fixed in
maven org.opencms:opencms-core
<6.2.2
6.2.2

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.