CVE-2022-35740
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. (This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users.) Some Java application frameworks, including those used by Spring or Tomcat, allow the use of matrix parameters: these are URI parameters separated by semicolons. Through precise semicolon placement in a URI, it is possible to exploit this feature to avoid dotCMS's path-based XSS prevention (such as "require login" filters), and consequently access restricted resources. For example, an attacker could place a semicolon immediately before a / character that separates elements of a filesystem path. This could reveal file content that is ordinarily only visible to signed-in users. This issue can be chained with other exploit code to achieve XSS attacks against dotCMS.
dotCMS anterior a 22.06 permite a atacantes remotos omitir el control de acceso previsto y obtener información confidencial utilizando un punto y coma en una URL para introducir un parámetro de matriz. (Esto también se corrigió en 5.3.8.12, 21.06.9 y 22.03.2 para usuarios de LTS). Algunos frameworks de aplicaciones Java, incluidos los utilizados por Spring o Tomcat, permiten el uso de parámetros matriciales: estos son parámetros URI separados por punto y coma. Mediante la colocación precisa de punto y coma en un URI, es posible explotar esta característica para evitar la prevención XSS basada en rutas de dotCMS (como los filtros "requerir inicio de sesión") y, en consecuencia, acceder a recursos restringidos. Por ejemplo, un atacante podría colocar un punto y coma inmediatamente antes del carácter / que separa los elementos de una ruta del sistema de archivos. Esto podría revelar contenido del archivo que normalmente solo es visible para los usuarios que han iniciado sesión. Este problema se puede encadenar con otro código de explotación para lograr ataques XSS contra dotCMS.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-07-13 CVE Reserved
- 2022-11-10 CVE Published
- 2024-06-02 EPSS Updated
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (2)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/dotCMS/patches-hotfixes/tree/master/com.dotcms.security.matrixparams | 2024-08-03 | |
| https://www.dotcms.com/security/SI-63 | 2024-08-03 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Dotcms Search vendor "Dotcms" | Dotcms Search vendor "Dotcms" for product "Dotcms" | >= 5.3.8 < 5.3.8.12 Search vendor "Dotcms" for product "Dotcms" and version " >= 5.3.8 < 5.3.8.12" | lts |
Affected
| ||||||
| Dotcms Search vendor "Dotcms" | Dotcms Search vendor "Dotcms" for product "Dotcms" | >= 21.06 < 21.06.9 Search vendor "Dotcms" for product "Dotcms" and version " >= 21.06 < 21.06.9" | lts |
Affected
| ||||||
| Dotcms Search vendor "Dotcms" | Dotcms Search vendor "Dotcms" for product "Dotcms" | >= 22.01 < 22.06 Search vendor "Dotcms" for product "Dotcms" and version " >= 22.01 < 22.06" | - |
Affected
| ||||||
| Dotcms Search vendor "Dotcms" | Dotcms Search vendor "Dotcms" for product "Dotcms" | >= 22.03 < 22.03.2 Search vendor "Dotcms" for product "Dotcms" and version " >= 22.03 < 22.03.2" | lts |
Affected
| ||||||