CVE-2020-18875

2021-08-1817:15:07

Google

osv.dev

cve-2020-18875

dotcms

access control

remote attack

client configurations

AI Score

7.2

Confidence

High

EPSS

0.004

Percentile

74.9%

JSON

Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges by injecting client configurations via vtl (velocity) files.

References

cwe.mitre.org/data/definitions/284.html

dotcms.com/security/SI-51

github.com/dotCMS/core/issues/15882