Denial of service

2023-02-0123:15:00

PRIOn knowledge base

www.prio-n.com

dotcms

tempresource

tomcat request-thread.

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.3%

JSON

In dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting the dotCMS server to download a large file. If done repeatedly, this will result in Tomcat request-thread exhaustion and ultimately a denial of any other requests.

CPENameOperatorVersion
dotcmslt21.06.12
dotcmsge22.03
dotcmslt22.03.4
dotcmsge5.2.0
dotcmslt22.10

Name	Operator	Version
dotcms	lt	21.06.12
dotcms	ge	22.03
dotcms	lt	22.03.4
dotcms	ge	5.2.0
dotcms	lt	22.10

References

www.dotcms.com/security/SI-65