Dotcms
Known Exploited Dotcms Vulnerabilities
The following Dotcms vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
Title | Description | Added |
---|---|---|
dotCMS Unrestricted Upload of File Vulnerability | dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution. CVE-2022-26352 | August 25, 2022 |
By the Year
In 2024 there have been 0 vulnerabilities in Dotcms . Last year Dotcms had 5 security vulnerabilities published. Right now, Dotcms is on track to have less security vulnerabilities in 2024 than it did last year.
Year | Vulnerabilities | Average Score |
---|---|---|
2024 | 0 | 0.00 |
2023 | 5 | 6.64 |
2022 | 3 | 7.33 |
2021 | 6 | 6.40 |
2020 | 3 | 7.80 |
2019 | 4 | 6.08 |
2018 | 2 | 5.75 |
It may take a day or so for new Dotcms vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Dotcms Security Vulnerabilities
In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes (//)
CVE-2023-3042
6.1 - Medium
- October 17, 2023
In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes (//) from URLs, potentially enabling bypasses for XSS and access controls. An example affected URL is https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.jsp https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.jsp , which should return a 404 response but didn't. The oversight in the default invalid URL character list can be viewed at the provided GitHub link https://github.com/dotCMS/core/blob/master/dotCMS/src/main/java/com/dotcms/filters/NormalizationFilter.java#L37 . To mitigate, users can block URLs with double slashes at firewalls or utilize dotCMS config variables. Specifically, they can use the DOT_URI_NORMALIZATION_FORBIDDEN_STRINGS environmental variable to add // to the list of invalid strings. Additionally, the DOT_URI_NORMALIZATION_FORBIDDEN_REGEX variable offers more detailed control, for instance, to block //html.* URLs. Fix Version:23.06+, LTS 22.03.7+, LTS 23.01.4+
XSS
In dotCMS 5.x-22.06
CVE-2022-37034
5.3 - Medium
- February 01, 2023
In dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting the dotCMS server to download a large file. If done repeatedly, this will result in Tomcat request-thread exhaustion and ultimately a denial of any other requests.
Stack Exhaustion
In dotCMS 5.x-22.06, TempFileAPI
CVE-2022-37033
6.5 - Medium
- February 01, 2023
In dotCMS 5.x-22.06, TempFileAPI allows a user to create a temporary file based on a passed in URL, while attempting to block any SSRF access to local IP addresses or private subnets. In resolving this URL, the TempFileAPI follows any 302 redirects that the remote URL returns. Because there is no re-validation of the redirect URL, the TempFileAPI can be used to return data from those local/private hosts that should not be accessible remotely.
XSPA
An issue was discovered in dotCMS core 4.x through 22.10.2
CVE-2022-45783
6.5 - Medium
- February 01, 2023
An issue was discovered in dotCMS core 4.x through 22.10.2. An authenticated directory traversal vulnerability in the dotCMS API can lead to Remote Code Execution.
Directory traversal
An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1
CVE-2022-45782
8.8 - High
- February 01, 2023
An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A cryptographically insecure random generation algorithm for password-reset token generation leads to account takeover.
PRNG
dotCMS before 22.06
CVE-2022-35740
6.1 - Medium
- November 10, 2022
dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. (This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users.) Some Java application frameworks, including those used by Spring or Tomcat, allow the use of matrix parameters: these are URI parameters separated by semicolons. Through precise semicolon placement in a URI, it is possible to exploit this feature to avoid dotCMS's path-based XSS prevention (such as "require login" filters), and consequently access restricted resources. For example, an attacker could place a semicolon immediately before a / character that separates elements of a filesystem path. This could reveal file content that is ordinarily only visible to signed-in users. This issue can be chained with other exploit code to achieve XSS attacks against dotCMS.
XSS
A Reflected Cross-site scripting (XSS) issue was discovered in dotCMS Core through 22.06
CVE-2022-37431
6.1 - Medium
- August 05, 2022
A Reflected Cross-site scripting (XSS) issue was discovered in dotCMS Core through 22.06. This occurs in the admin portal when the configuration has XSS_PROTECTION_ENABLED=false. NOTE: the vendor disputes this because the current product behavior, in effect, has XSS_PROTECTION_ENABLED=true in all configurations
XSS
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02
CVE-2022-26352
9.8 - Critical
- July 17, 2022
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.
Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier
CVE-2020-19138
9.8 - Critical
- September 08, 2021
Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote attackers to execute arbitrary code via the component "/src/main/java/com/dotmarketing/filters/CMSFilter.java".
Unrestricted File Upload
Incorrect Access Control in DotCMS versions before 5.1
CVE-2020-18875
8.8 - High
- August 18, 2021
Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges by injecting client configurations via vtl (velocity) files.
Injection
A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/containers of dotCMS 21.05.1
CVE-2021-35360
4.8 - Medium
- July 09, 2021
A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/containers of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a crafted payload.
XSS
A stored cross site scripting (XSS) vulnerability in dotAdmin/#/c/c_Images of dotCMS 21.05.1
CVE-2021-35358
4.8 - Medium
- July 09, 2021
A stored cross site scripting (XSS) vulnerability in dotAdmin/#/c/c_Images of dotCMS 21.05.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' and 'Filename' parameters.
XSS
A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/links of dotCMS 21.05.1
CVE-2021-35361
4.8 - Medium
- July 09, 2021
A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/links of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a crafted payload.
XSS
Cross Site Scripting (XSS) in dotCMS v5.1.5
CVE-2020-17542
5.4 - Medium
- April 23, 2021
Cross Site Scripting (XSS) in dotCMS v5.1.5 allows remote attackers to execute arbitrary code by injecting a malicious payload into the "Task Detail" comment window of the "/dotAdmin/#/c/workflow" component.
XSS
dotCMS before 20.10.1 allows SQL injection, as demonstrated by the /api/v1/containers orderby parameter
CVE-2020-27848
8.8 - High
- December 30, 2020
dotCMS before 20.10.1 allows SQL injection, as demonstrated by the /api/v1/containers orderby parameter. The PaginatorOrdered classes that are used to paginate results of a REST endpoints do not sanitize the orderBy parameter and in some cases it is vulnerable to SQL injection attacks. A user must be an authenticated manager in the dotCMS system to exploit this vulnerability.
SQL Injection
DotCMS Add Template with admin panel 20.11 is affected by cross-site Scripting (XSS) to gain remote privileges
CVE-2020-35274
4.8 - Medium
- December 21, 2020
DotCMS Add Template with admin panel 20.11 is affected by cross-site Scripting (XSS) to gain remote privileges. An attacker could compromise the security of a website or web application through a stored XSS attack and stealing cookies using XSS.
XSS
dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control
CVE-2020-6754
9.8 - Critical
- February 05, 2020
dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It allows an attacker to read or execute files under $TOMCAT_HOME/webapps/ROOT/assets (which should be a protected directory). Additionally, attackers can upload temporary files (e.g., .jsp files) into /webapps/ROOT/assets/tmp_upload, which can lead to remote command execution (with the permissions of the user running the dotCMS application).
Unrestricted File Upload
dotCMS before 5.1.6 is vulnerable to a SQL injection
CVE-2019-12872
7.2 - High
- June 18, 2019
dotCMS before 5.1.6 is vulnerable to a SQL injection that can be exploited by an attacker of the role Publisher via view_unpushed_bundles.jsp.
SQL Injection
dotCMS before 5.1.0 has a path traversal vulnerability exploitable by an administrator to create files
CVE-2019-12309
4.9 - Medium
- May 23, 2019
dotCMS before 5.1.0 has a path traversal vulnerability exploitable by an administrator to create files. The vulnerability is caused by the insecure extraction of a ZIP archive.
Directory traversal
/servlets/ajax_file_upload?fieldName=binary3 in dotCMS 5.1.1
CVE-2019-11846
6.1 - Medium
- May 14, 2019
/servlets/ajax_file_upload?fieldName=binary3 in dotCMS 5.1.1 allows XSS and HTML Injection.
XSS
dotCMS before 5.0.2 has open redirects
CVE-2018-17422
6.1 - Medium
- March 07, 2019
dotCMS before 5.0.2 has open redirects via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext/common/page_preview_popup.jsp hostname parameter.
Open Redirect
An issue was discovered in Dotcms through 5.0.3
CVE-2018-19554
5.4 - Medium
- November 26, 2018
An issue was discovered in Dotcms through 5.0.3. Attackers may perform XSS attacks via the inode, identifier, or fieldName parameter in html/js/dotcms/dijit/image/image_tool.jsp.
XSS
dotCMS V5.0.1 has XSS in the /html/portlet/ext/contentlet/image_tools/index.jsp fieldName and inode parameters.
CVE-2018-16980
6.1 - Medium
- September 12, 2018
dotCMS V5.0.1 has XSS in the /html/portlet/ext/contentlet/image_tools/index.jsp fieldName and inode parameters.
XSS