CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-37033
https://notcve.org/view.php?id=CVE-2022-37033
In dotCMS 5.x-22.06, TempFileAPI allows a user to create a temporary file based on a passed in URL, while attempting to block any SSRF access to local IP addresses or private subnets. In resolving this URL, the TempFileAPI follows any 302 redirects that the remote URL returns. Because there is no re-validation of the redirect URL, the TempFileAPI can be used to return data from those local/private hosts that should not be accessible remotely. • https://www.dotcms.com/security/SI-64 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2022-37034
https://notcve.org/view.php?id=CVE-2022-37034
In dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting the dotCMS server to download a large file. If done repeatedly, this will result in Tomcat request-thread exhaustion and ultimately a denial of any other requests. • https://www.dotcms.com/security/SI-65 • CWE-674: Uncontrolled Recursion •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-37431
https://notcve.org/view.php?id=CVE-2022-37431
A Reflected Cross-site scripting (XSS) issue was discovered in dotCMS Core through 22.06. This occurs in the admin portal when the configuration has XSS_PROTECTION_ENABLED=false. NOTE: the vendor disputes this because the current product behavior, in effect, has XSS_PROTECTION_ENABLED=true in all configurations ** EN DISPUTA ** Se ha detectado un problema de tipo Cross-site scripting (XSS) Reflejado en dotCMS Core versiones hasta 22.06. Esto ocurre en el portal de administración cuando la configuración presenta XSS_PROTECTION_ENABLED=false. NOTA: el proveedor discute esto porque el comportamiento actual del producto, en efecto, tiene XSS_PROTECTION_ENABLED=true en todas las configuraciones • https://fortiguard.fortinet.com/zeroday/FG-VD-22-062 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2020-19138
https://notcve.org/view.php?id=CVE-2020-19138
Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote attackers to execute arbitrary code via the component "/src/main/java/com/dotmarketing/filters/CMSFilter.java". Una Carga no Restringida de Archivos de Tipo Peligroso en DotCMS versión v5.2.3 y anteriores, permite a atacantes remotos ejecutar código arbitrario por medio del componente "/src/main/java/com/dotmarketing/filters/CMSFilter.java" • https://github.com/dotCMS/core/issues/17796 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-18875
https://notcve.org/view.php?id=CVE-2020-18875
Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges by injecting client configurations via vtl (velocity) files. Un Control de Acceso Incorrecto en DotCMS versiones anteriores a 5.1, permite a atacantes remotos alcanzar privilegios al inyectar configuraciones de clientes por medio de archivos vtl (velocity). • https://cwe.mitre.org/data/definitions/284.html https://dotcms.com/security/SI-51 https://github.com/dotCMS/core/issues/15882 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •