A pegada
OpenCms is commonly deployed as an enterprise CMS, where an XML parser bug can sit behind legacy content or integration endpoints. CVE-2023-42344 is tied to affected OpenCms versions before 10.5.1; FixVibe treats a repo match as dependency evidence, not proof that the vulnerable servlet is deployed and reachable.
Como funciona
The repo check looks for `org.opencms:opencms-core` in Maven dependency declarations. Exact versions in `pom.xml` produce the strongest signal, including versions referenced through local Maven properties. The finding stays scoped to dependency evidence and does not claim FixVibe sent XML payloads or confirmed file disclosure.
O raio de impacto
If an affected OpenCms runtime exposes the vulnerable XML-processing path, unauthenticated attackers may be able to trigger XXE behavior that discloses host information or reaches internal resources. A repo match should drive an upgrade and deployment review before anyone treats it as confirmed runtime exposure.
// what fixvibe checks
What FixVibe checks
FixVibe repo scans look for high-confidence security patterns and dependency risk in source context. Reports identify the affected area and recommended fix. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
Defesas blindadas
Upgrade `org.opencms:opencms-core` to 10.5.1 or newer, rebuild and redeploy the OpenCms artifact, and verify the running service no longer uses the affected version. If this repo only carries a dormant or inherited CMS module, confirm whether it ships to production before closing the advisory.