CVE-2006-3936
Alkacon OpenCms Exposes JSP Source Code
system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using index.jsp.
Exploit likelihood
What each source reports
NVD Score used
system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using index.jsp.
- Record
CVE-2006-3936- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using index.jsp.
- Record
CVE-2006-3936- Updated
- 2026-11-02
EUVDEUVD-2022-3514 No score
system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using index.jsp.
- Record
EUVD-2022-3514- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c5vw-342h-x5rx No score
Alkacon OpenCms Exposes JSP Source Code
system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using index.jsp.
- Record
GHSA-c5vw-342h-x5rx- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-c5vw-342h-x5rx No score
Alkacon OpenCms Exposes JSP Source Code
system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using index.jsp.
- Record
GHSA-c5vw-342h-x5rx- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.opencms:opencms-coreMaven |
before 6.2.2 | 6.2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-3936 is a medium vulnerability (CVSS 4.0) in Alkacon Opencms, published July 31, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. Fixed in org.opencms:opencms-core 6.2.2.
References
secunia.com/advisories/21193
exchange.xforce.ibmcloud.com/vulnerabilities/28001
opencms.org/opencms/en/shownews.html?id=1002
securityreason.com/securityalert/1302
securityfocus.com/archive/1/441182/100/0/threaded
o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txt
Show 6 moreShow less
nvd.nist.gov/vuln/detail/CVE-2006-3936
web.archive.org/web/20061014175017/http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txt
github.com/advisories/GHSA-c5vw-342h-x5rx