PT-2023-14751 · Dotcms · Dotcms

Publicado 2023-02-01 · Atualizado 2025-03-27 · CVE-2022-45782

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dotCMS core versions 5.3.8.5 through 5.3.8.15 dotCMS core versions 21.03 through 22.10.1

Description An issue was discovered in dotCMS core where a cryptographically insecure random generation algorithm is used for password-reset token generation, leading to account takeover.

Recommendations For versions 5.3.8.5 through 5.3.8.15, update to a version outside of this range to resolve the issue. For versions 21.03 through 22.10.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider disabling the password-reset feature until a patch is available. Restrict access to the password-reset functionality to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-338

Identificadores relacionados

CVE-2022-45782

Produtos afetados

Dotcms

Referências · 7

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45782 · Nota
• https://t.me/cvenotify/116551 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-45782 · Nota de Segurança
• https://dotcms.com/security/SI-66 · Aviso do Fabricante
• https://t.me/cvenotify/43389 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-45782 · Aviso do Fabricante
• https://t.me/cibsecurity/57362 · Publicação no Telegram