CVE-2022-37034

In dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting the dotCMS server to download a large file. If done repeatedly, this will result in Tomcat request-thread exhaustion and ultimately a denial of any other requests...

CVE-2022-37034

dotCMS 5.x-22.06 is affected by a denial-of-service condition when TempResource is called repeatedly to download large files, exhausting Tomcat request threads and denying other requests. The connected documents provide this description without including exploit details or a remediation. No other...

CVE-2022-37033

In dotCMS 5.x-22.06, the TempFileAPI vulnerability allows a user to create a temporary file from a supplied URL, because the API does not re-validate 302 redirects when resolving the remote URL. This enables potential access to data on local or private hosts that should not be reachable remotely,...

CVE-2022-45782

An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A cryptographically insecure random generation algorithm for password-reset token generation leads to account takeover...

dotCMS security vulnerability

dotCMS is a content management system CMS from the United States dotCMS. The system supports modules such as RSS feeds, blogs, and forums, and is easy to extend and build. A security vulnerability exists in dotCMS version 5.x-22.06, which stems from the ability to call TempResource multiple times...

dotCMS security feature vulnerability

dotCMS is a content management system CMS from the United States dotCMS. The system supports modules such as RSS feeds, blogs, forums, etc., and is easy to extend and build. A security signature issue vulnerability exists in dotCMS core versions 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1,...

PT-2023-14752

Name of the Vulnerable Software and Affected Versions dotCMS core versions 4.x through 22.10.2 Description An issue was discovered in the dotCMS core, where an authenticated directory traversal vulnerability in the dotCMS API can lead to Remote Code Execution. Recommendations For dotCMS core...

CVE-2022-45783

An issue was discovered in dotCMS core 4.x through 22.10.2. An authenticated directory traversal vulnerability in the dotCMS API can lead to Remote Code Execution...

dotCMS path traversal vulnerability

dotCMS is a content management system CMS from the United States dotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A path traversal vulnerability exists in dotCMS core, which stems from the fact that an authenticated attacker can...

PT-2023-13519

Name of the Vulnerable Software and Affected Versions dotCMS versions 5.x through 22.06 Description The issue allows a user to create a temporary file based on a passed-in URL using the TempFileAPI, which attempts to block Server-Side Request Forgery SSRF access to local IP addresses or private...

CVE-2022-45782

An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A cryptographically insecure random generation algorithm for password-reset token generation leads to account takeover...

CVE-2022-35740

dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users. Some Java application frameworks, including those used ...

Path traversal

dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users. Some Java application frameworks, including those used ...

PT-2022-22958 · Dotcms · Dotcms

Name of the Vulnerable Software and Affected Versions: dotCMS versions prior to 22.06 dotCMS version 5.3.8.12 dotCMS version 21.06.9 dotCMS version 22.03.2 Description: The issue allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a U...

CVE-2022-35740

dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users. Some Java application frameworks, including those used ...

CVE-2022-35740

dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users. Some Java application frameworks, including those used ...

CVE-2022-35740

CVE-2022-35740 : dotCMS before 22.06 allows remote attackers to bypass access controls and access restricted resources by placing a semicolon in a URL to introduce a matrix parameter, enabling path-based XSS bypass in some frameworks (e.g., Spring/Tomcat). The issue can chain into XSS; impact pub...

CVE-2022-35740

dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users. Some Java application frameworks, including those used ...

CVE-2022-35740: Improper Neutralization of Input During Web Page Generation

dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users. Some Java application frameworks, including those used ...

dotCMS cross-site scripting vulnerability

dotCMS is a content management system CMS from the United States dotCMS. The system supports modules such as RSS feeds, blogs, and forums, and is easy to extend and build. A security vulnerability exists in dotCMS versions prior to 22.06, which stems from a vulnerability that allows a remote...