CVE-2022-26352

Produto

dotCMS / dotCMS

Vulnerabilidade

dotCMS Unrestricted Upload of File Vulnerability

Adicionado ao KEV

25 de ago. de 2022

Corrigir até

15 de set. de 2022

Uso conhecido em ransomware

Sim

Descrição resumida

dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution.

Ação necessária

Apply updates per vendor instructions.

Notas

https://www.dotcms.com/security/SI-62; https://nvd.nist.gov/vuln/detail/CVE-2022-26352