CVE-2016-2355

Critical

Published: 19/12/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In dotCMS before version 3.3.2, there is an SQL injection vulnerability in the REST API that allows remote attackers to execute arbitrary SQL commands via the stName parameter to api/content/save/1.

Risk Assessment

This vulnerability could lead to unauthorized access to the database and potential data loss or modification.

Recommendation

It is recommended to upgrade dotCMS to version 3.3.2 or later to mitigate this vulnerability.

Original NVD description (English source)

SQL injection vulnerability in the REST API in dotCMS before 3.3.2 allows remote attackers to execute arbitrary SQL commands via the stName parameter to api/content/save/1.