CVE-2008-1300
Alkacon Open CMS XSS via Logfile Viewer Settings function
Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote attackers to inject arbitrary web script or HTML via the filePath.0 parameter in a save action, a different vector than CVE-2008-1045.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote attackers to inject arbitrary web script or HTML via the filePath.0 parameter in a save action, a different vector than CVE-2008-1045.
- Record
CVE-2008-1300- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote attackers to inject arbitrary web script or HTML via the filePath.0 parameter in a save action, a different vector than CVE-2008-1045.
- Record
CVE-2008-1300- Updated
- 2026-11-02
EUVDEUVD-2008-1307 No score
Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote attackers to inject arbitrary web script or HTML via the filePath.0 parameter in a save action, a different vector than CVE-2008-1045.
- Record
EUVD-2008-1307- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w3v2-vfrj-j9g8
Alkacon Open CMS XSS via Logfile Viewer Settings function
Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote attackers to inject arbitrary web script or HTML via the filePath.0 parameter in a save action, a different vector than CVE-2008-1045.
- Record
GHSA-w3v2-vfrj-j9g8- CVSS 4.0
- 1.3 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-w3v2-vfrj-j9g8
Alkacon Open CMS XSS via Logfile Viewer Settings function
Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote attackers to inject arbitrary web script or HTML via the filePath.0 parameter in a save action, a different vector than CVE-2008-1045.
- Record
GHSA-w3v2-vfrj-j9g8- CVSS 4.0
- 1.3 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.opencms:opencms-coreMaven |
7.0.3 up to 7.0.5 | 7.0.5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Alkacon OpenCMS 7.0.3 - 'logfileViewSettings.jsp?filePath' Cross-Site Scripting | 2008-03-08 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1300 is a medium vulnerability (CVSS 4.3) in Alkacon Opencms, published March 12, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.51%, the 74th percentile. Fixed in org.opencms:opencms-core 7.0.5.
References
securityfocus.com/bid/28152
exchange.xforce.ibmcloud.com/vulnerabilities/41095
securityreason.com/securityalert/3731
secunia.com/advisories/29278
nvd.nist.gov/vuln/detail/CVE-2008-1300
github.com/alkacon/opencms-core/commit/7b73b5559c1b025dfe0f7b38ed4119c25b9df409