Lucene search
PRIOn knowledge basePRION:CVE-2020-27848HistoryDec 30, 2020 - 7:15 p.m.
Sql injection
2020-12-3019:15:00
PRIOn knowledge base
www.prio-n.com
3
dotCMS before 20.10.1 allows SQL injection, as demonstrated by the /api/v1/containers orderby parameter. The PaginatorOrdered classes that are used to paginate results of a REST endpoints do not sanitize the orderBy parameter and in some cases it is vulnerable to SQL injection attacks. A user must be an authenticated manager in the dotCMS system to exploit this vulnerability.
Related
cvelist
cvelist
CVE-2020-27848
2020-12-30 18:24:20
cve
cve
CVE-2020-27848
2020-12-30 19:15:13
osv
osv
CVE-2020-27848
2020-12-30 19:15:13
nvd
nvd
CVE-2020-27848
2020-12-30 19:15:13