- Vendor / Project
- dotCMS
- Product
- dotCMS
- Date added
- Aug 25, 2022
- Due date
- Sep 15, 2022
- Known ransomware use
- Known
- CWEs
- CWE-22, CWE-138
Description
dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution.
Required action
Apply updates per vendor instructions.