CVE-2016-3972

2016-04-1815:00:00

mitre

www.cve.org

4.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.0%

JSON

Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a … (dot dot) in the fileName parameter.

References

dotcms.com/security/SI-34

seclists.org/fulldisclosure/2016/Apr/36