CVSS: 9.8EPSS: 17%CPEs: 1EXPL: 2CVE-2020-6754
https://notcve.org/view.php?id=CVE-2020-6754
dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It allows an attacker to read or execute files under $TOMCAT_HOME/webapps/ROOT/assets (which should be a protected directory). Additionally, attackers can upload temporary files (e.g., .jsp files) into /webapps/ROOT/assets/tmp_upload, which can lead to remote command execution (with the permissions of the user running the dotCMS application). dotCMS versiones anteriores a 5.2.4, es vulnerable a salto de directorio, lo que conlleva a un control de acceso incorrecto. Permite a un atacante leer o ejecutar archivos bajo $TOMCAT_HOME/webapps/ROOT/assets (que debería ser un directorio protegido). Además, los atacantes pueden cargar archivos temporales (por ejemplo, archivos .jsp) en /webapps/ROOT/assets/tmp_upload, lo que puede conllevar a una ejecución de comandos remota (con los permisos del usuario que ejecuta la aplicación dotCMS). • https://dotcms.com/security/SI-54 https://github.com/dotCMS/core/issues/17796 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12872
https://notcve.org/view.php?id=CVE-2019-12872
dotCMS before 5.1.6 is vulnerable to a SQL injection that can be exploited by an attacker of the role Publisher via view_unpushed_bundles.jsp. dotCMS anterior de 5.1.6 es vulnerable a una inyección de SQL que puede ser aprovechada por un atacante del publicador de roles a través de view_unpushed_bundles.jsp. • https://dotcms.com/security/SI-53 https://github.com/dotCMS/core/issues/16624 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12309
https://notcve.org/view.php?id=CVE-2019-12309
dotCMS before 5.1.0 has a path traversal vulnerability exploitable by an administrator to create files. The vulnerability is caused by the insecure extraction of a ZIP archive. dotCMS anterior a la versión 5.1.0, tiene una vulnerabilidad de control incorrecto a rutas de directorios restringidos (path traversal) explotable por un administrador para crear archivos. La vulnerabilidad es causa la extracción insegura de un archivo ZIP. • https://dotcms.com/security/SI-48 https://github.com/dotCMS/core/compare/605e5db...364c910 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-11846 – dotCMS 5.1.1 HTML Injection
https://notcve.org/view.php?id=CVE-2019-11846
/servlets/ajax_file_upload?fieldName=binary3 in dotCMS 5.1.1 allows XSS and HTML Injection. / servlets / ajax_file_upload? fieldName = binary3 en dotCMS 5.1.1 permite XSS y HTML Injection. dotCMS version 5.1.1 suffers from an html injection vulnerability. • http://packetstormsecurity.com/files/152788/dotCMS-5.1.1-HTML-Injection.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-17422
https://notcve.org/view.php?id=CVE-2018-17422
dotCMS before 5.0.2 has open redirects via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext/common/page_preview_popup.jsp hostname parameter. dotCMS, en versiones anteriores a la 5.0.2, tiene redireccionamientos abiertos mediante los parámetros FORWARD_URL en html/common/forward_js.jsp o hostname en html/portlet/ext/common/page_preview_popup.jsp. • https://github.com/dotCMS/core/issues/15286 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •