dotCMS vulnerabilities

In dotCMS version 4.1.1, there is an arbitrary file upload vulnerability that allows remote authenticated administrators to upload .jsp files to arbitrary locations via directory traversal sequences in the fieldName parameter. This can lead to arbitrary code execution by requesting the .jsp file at an /assets URI.

SQL injection vulnerability in the 'Site Browser > HTML pages' screen in dotCMS before version 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.

In dotCMS before version 3.3.1, there is an SQL injection vulnerability in the 'Content Types > Content Types' screen that allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.

In dotCMS before version 3.3.1, there is an SQL injection vulnerability in the 'Site Browser > Links pages' screen. This allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.

In dotCMS before version 3.3.1, there is an SQL injection vulnerability in the 'Site Browser > Containers pages' screen. This allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.

In dotCMS before version 3.3.1, there is an SQL injection vulnerability in the 'Site Browser > Templates pages' screen that allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.

In dotCMS version 3.2.1, an attacker can load captcha once, fill it with the correct value, and then this correct value will be accepted for forms with captcha check later.

CRLF injection vulnerability in the send email functionality in dotCMS before 3.3.2 allows remote attackers to inject arbitrary email headers via CRLF sequences in the subject.

Vulnerability in dotCMS (versions 21.02 through 26.06.22-03) in ToolGroupResource and RoleAjax REST/DWR endpoints. A low-privileged authenticated backend user can self-assign the CMS Administrator role and achieve remote code execution via a crafted OSGi bundle upload.

An issue was discovered in dotCMS through 3.6.1 related to the findChildrenByFilter() function, which performs string interpolation and direct SQL query execution. Although SQL quote escaping and a keyword blacklist were implemented, they can be bypassed for the q and inode parameters, leading to potential SQL injection attacks.

DotCMS Add Template with admin panel 20.11 is affected by stored Cross-Site Scripting (XSS) that allows an attacker to steal cookies and gain remote privileges. This compromises the security of the web application.