CVE-2022-37034

dotCMS 5.x-22.06 is affected by a denial-of-service condition when TempResource is called repeatedly to download large files, exhausting Tomcat request threads and denying other requests. The connected documents provide this description without including exploit details or a remediation. No other...

CVE-2022-37033

In dotCMS 5.x-22.06, the TempFileAPI vulnerability allows a user to create a temporary file from a supplied URL, because the API does not re-validate 302 redirects when resolving the remote URL. This enables potential access to data on local or private hosts that should not be reachable remotely,...

CVE-2022-45782

An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A cryptographically insecure random generation algorithm for password-reset token generation leads to account takeover...

CVE-2022-37033

In dotCMS 5.x-22.06, TempFileAPI allows a user to create a temporary file based on a passed in URL, while attempting to block any SSRF access to local IP addresses or private subnets. In resolving this URL, the TempFileAPI follows any 302 redirects that the remote URL returns. Because there is no...

CVE-2022-35740

dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users. Some Java application frameworks, including those used ...

Path traversal

dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users. Some Java application frameworks, including those used ...

CVE-2022-35740

dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users. Some Java application frameworks, including those used ...

PT-2022-22958 · Dotcms · Dotcms

Name of the Vulnerable Software and Affected Versions: dotCMS versions prior to 22.06 dotCMS version 5.3.8.12 dotCMS version 21.06.9 dotCMS version 22.03.2 Description: The issue allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a U...

dotCMS 跨站脚本漏洞

dotCMS is a content management system CMS from the United States dotCMS. The system supports modules such as RSS feeds, blogs, and forums, and is easy to extend and build. A security vulnerability exists in dotCMS versions prior to 22.06, which stems from a vulnerability that allows a remote...

CVE-2022-35740

CVE-2022-35740 : dotCMS before 22.06 allows remote attackers to bypass access controls and access restricted resources by placing a semicolon in a URL to introduce a matrix parameter, enabling path-based XSS bypass in some frameworks (e.g., Spring/Tomcat). The issue can chain into XSS; impact pub...

CVE-2022-35740

dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users. Some Java application frameworks, including those used ...

The vulnerability of the dotCMS content management system’s administration portal allows attackers to carry out cross-site scripting attacks.

The vulnerability of the dotCMS content management system’s administration portal is related to the lack of measures taken to protect the website structure when the configuration value XSSPROTECTIONENABLED is set to false. Exploiting this vulnerability could allow a remote attacker to perform...

DotCMS 3.x < 5.3.8.10 / 21.x < 21.06.7 / 22.x < 22.03 Remote Code Execution

An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous...

dotCMS Unrestricted Upload of File Vulnerability

dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution...

dotCMS Arbitrary File Upload (CVE-2022-26352; CVE-2018-5445)

An arbitrary file upload vulnerability exists in dotCMS. Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the vulnerable system with administrative privileges...

CVE-2022-37431

A Reflected Cross-site scripting XSS issue was discovered in dotCMS Core through 22.06. This occurs in the admin portal when the configuration has XSSPROTECTIONENABLED=false. NOTE: the vendor disputes this because the current product behavior, in effect, has XSSPROTECTIONENABLED=true in all...

CVE-2022-37431

A Reflected Cross-site scripting XSS issue was discovered in dotCMS Core through 22.06. This occurs in the admin portal when the configuration has XSSPROTECTIONENABLED=false. NOTE: the vendor disputes this because the current product behavior, in effect, has XSSPROTECTIONENABLED=true in all...

Cross site scripting

DISPUTED A Reflected Cross-site scripting XSS issue was discovered in dotCMS Core through 22.06. This occurs in the admin portal when the configuration has XSSPROTECTIONENABLED=false. NOTE: the vendor disputes this because the current product behavior, in effect, has XSSPROTECTIONENABLED=true in...

CVE-2022-37431

A Reflected Cross-site scripting XSS issue was discovered in dotCMS Core through 22.06. This occurs in the admin portal when the configuration has XSSPROTECTIONENABLED=false. NOTE: the vendor disputes this because the current product behavior, in effect, has XSSPROTECTIONENABLED=true in all...

CVE-2022-37431

CVE-2022-37431 affects dotCMS Core (through 22.06). The issue is a reflected cross-site scripting (XSS) in the admin portal when XSS_PROTECTION_ENABLED is false; vendor notes suggest the product already behaves with XSS_PROTECTION_ENABLED=true in all configurations. Impact is reflected XSS in adm...