CVSS: 9.8EPSS: 97%CPEs: 1EXPL: 2CVE-2022-26352 – dotCMS Unrestricted Upload of File Vulnerability
https://notcve.org/view.php?id=CVE-2022-26352
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution. Se ha detectado un problema en la API ContentResource de dotCMS versiones 3.0 hasta 22.02. • http://packetstormsecurity.com/files/167365/dotCMS-Shell-Upload.html https://groups.google.com/g/dotcms https://blog.assetnote.io/2022/05/03/hacking-a-bank-using-dotcms-rce https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/dotcms_file_upload_rce.rb •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2020-19138
https://notcve.org/view.php?id=CVE-2020-19138
Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote attackers to execute arbitrary code via the component "/src/main/java/com/dotmarketing/filters/CMSFilter.java". Una Carga no Restringida de Archivos de Tipo Peligroso en DotCMS versión v5.2.3 y anteriores, permite a atacantes remotos ejecutar código arbitrario por medio del componente "/src/main/java/com/dotmarketing/filters/CMSFilter.java" • https://github.com/dotCMS/core/issues/17796 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-17542
https://notcve.org/view.php?id=CVE-2020-17542
Cross Site Scripting (XSS) in dotCMS v5.1.5 allows remote attackers to execute arbitrary code by injecting a malicious payload into the "Task Detail" comment window of the "/dotAdmin/#/c/workflow" component. Una vulnerabilidad de tipo Cross Site Scripting (XSS) en dotCMS versión v5.1.5, permite a atacantes remotos ejecutar código arbitrario al inyectar una carga útil maliciosa en la ventana de comentarios "Task Detail" del componente "/dotAdmin/#/c/workflow" • https://github.com/dotCMS/core/issues/16890 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-27848
https://notcve.org/view.php?id=CVE-2020-27848
dotCMS before 20.10.1 allows SQL injection, as demonstrated by the /api/v1/containers orderby parameter. The PaginatorOrdered classes that are used to paginate results of a REST endpoints do not sanitize the orderBy parameter and in some cases it is vulnerable to SQL injection attacks. A user must be an authenticated manager in the dotCMS system to exploit this vulnerability. dotCMS versiones anteriores a 20.10.1, permite una inyección SQL, como es demostrado por el parámetro orderby del archivo arch/api/v1/containers. Las clases PaginatorOrdered que son usadas para paginar los resultados de un endpoint REST no sanean el parámetro orderBy y, en algunos casos, es vulnerable a ataques de inyección SQL. Un usuario debe ser un administrador autenticado en el sistema dotCMS para explotar esta vulnerabilidad. • https://github.com/dotCMS/core/compare/v5.3.8.1...v20.10.1 https://github.com/dotCMS/core/issues/19500 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 17%CPEs: 1EXPL: 2CVE-2020-6754
https://notcve.org/view.php?id=CVE-2020-6754
dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It allows an attacker to read or execute files under $TOMCAT_HOME/webapps/ROOT/assets (which should be a protected directory). Additionally, attackers can upload temporary files (e.g., .jsp files) into /webapps/ROOT/assets/tmp_upload, which can lead to remote command execution (with the permissions of the user running the dotCMS application). dotCMS versiones anteriores a 5.2.4, es vulnerable a salto de directorio, lo que conlleva a un control de acceso incorrecto. Permite a un atacante leer o ejecutar archivos bajo $TOMCAT_HOME/webapps/ROOT/assets (que debería ser un directorio protegido). Además, los atacantes pueden cargar archivos temporales (por ejemplo, archivos .jsp) en /webapps/ROOT/assets/tmp_upload, lo que puede conllevar a una ejecución de comandos remota (con los permisos del usuario que ejecuta la aplicación dotCMS). • https://dotcms.com/security/SI-54 https://github.com/dotCMS/core/issues/17796 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-434: Unrestricted Upload of File with Dangerous Type •