CVE-2022-26352criticalunder attackransomware

CVE-2022-26352

Published · Updated

Follow this CVE+ Monitor dotCMS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 91%
from disclosure to weaponsame day
Published on NVDJul 17
metasploitMay 3
CISA KEV+39d
Action required by CISAfederal deadline: 2022-09-15

Apply updates per vendor instructions.

In short

A vulnerability in dotCMS allows attackers to upload files with unsanitized names, enabling them to save files outside the intended directory and execute malicious code on the server without needing authentication.

Technical detail

The ContentResource API in dotCMS 3.0–22.02 fails to sanitize filenames in multipart form requests, enabling directory traversal attacks. Unauthenticated attackers can exploit this (when anonymous content creation is enabled) to upload executable files (e.g., .jsp) to arbitrary locations, achieving remote code execution on the server.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.