CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2022-37034
https://notcve.org/view.php?id=CVE-2022-37034
In dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting the dotCMS server to download a large file. If done repeatedly, this will result in Tomcat request-thread exhaustion and ultimately a denial of any other requests. • https://www.dotcms.com/security/SI-65 • CWE-674: Uncontrolled Recursion •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-37033
https://notcve.org/view.php?id=CVE-2022-37033
In dotCMS 5.x-22.06, TempFileAPI allows a user to create a temporary file based on a passed in URL, while attempting to block any SSRF access to local IP addresses or private subnets. In resolving this URL, the TempFileAPI follows any 302 redirects that the remote URL returns. Because there is no re-validation of the redirect URL, the TempFileAPI can be used to return data from those local/private hosts that should not be accessible remotely. • https://www.dotcms.com/security/SI-64 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-37431
https://notcve.org/view.php?id=CVE-2022-37431
A Reflected Cross-site scripting (XSS) issue was discovered in dotCMS Core through 22.06. This occurs in the admin portal when the configuration has XSS_PROTECTION_ENABLED=false. NOTE: the vendor disputes this because the current product behavior, in effect, has XSS_PROTECTION_ENABLED=true in all configurations ** EN DISPUTA ** Se ha detectado un problema de tipo Cross-site scripting (XSS) Reflejado en dotCMS Core versiones hasta 22.06. Esto ocurre en el portal de administración cuando la configuración presenta XSS_PROTECTION_ENABLED=false. NOTA: el proveedor discute esto porque el comportamiento actual del producto, en efecto, tiene XSS_PROTECTION_ENABLED=true en todas las configuraciones • https://fortiguard.fortinet.com/zeroday/FG-VD-22-062 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 97%CPEs: 1EXPL: 2CVE-2022-26352 – dotCMS Unrestricted Upload of File Vulnerability
https://notcve.org/view.php?id=CVE-2022-26352
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution. Se ha detectado un problema en la API ContentResource de dotCMS versiones 3.0 hasta 22.02. • http://packetstormsecurity.com/files/167365/dotCMS-Shell-Upload.html https://groups.google.com/g/dotcms https://blog.assetnote.io/2022/05/03/hacking-a-bank-using-dotcms-rce https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/dotcms_file_upload_rce.rb •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2020-19138
https://notcve.org/view.php?id=CVE-2020-19138
Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote attackers to execute arbitrary code via the component "/src/main/java/com/dotmarketing/filters/CMSFilter.java". Una Carga no Restringida de Archivos de Tipo Peligroso en DotCMS versión v5.2.3 y anteriores, permite a atacantes remotos ejecutar código arbitrario por medio del componente "/src/main/java/com/dotmarketing/filters/CMSFilter.java" • https://github.com/dotCMS/core/issues/17796 • CWE-434: Unrestricted Upload of File with Dangerous Type •