CVE-2022-37033

In dotCMS 5.x-22.06, TempFileAPI allows a user to create a temporary file based on a passed in URL, while attempting to block any SSRF access to local IP addresses or private subnets. In resolving this URL, the TempFileAPI follows any 302 redirects that the remote URL returns. Because there is no...

CVE-2022-37033

In dotCMS 5.x-22.06, the TempFileAPI vulnerability allows a user to create a temporary file from a supplied URL, because the API does not re-validate 302 redirects when resolving the remote URL. This enables potential access to data on local or private hosts that should not be reachable remotely,...