PT-2018-7244 · Dotcms · Dotcms

Darong Tong + 2 · Published 2018-07-24 · Updated 2019-10-09 · CVE-2017-3188

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: dotCMS versions 3.7.1 and earlier

Description: The issue concerns the "Push Publishing" feature in Enterprise Pro, where the dotCMS administration panel is vulnerable to path traversal. This occurs when "Bundle" tar.gz archives are uploaded and decompressed, allowing files to be written to arbitrary directories due to improper filename checking. An unauthenticated remote attacker can exploit this to perform actions with the same permissions as a victim user or execute arbitrary system commands with the permissions of the user running the dotCMS application.

Recommendations: For dotCMS versions 3.7.1 and earlier, as a temporary workaround, consider disabling the "Push Publishing" feature until a patch is available. Restrict access to the administration panel to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-3188

Affected Products

Dotcms

References · 6

• https://doc.dotcms.com/security/SI-41 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3188 · Security Note
• https://osv.dev/vulnerability/CVE-2017-3188 · Vendor Advisory
• http://securityfocus.com/bid/96616 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3188 · Note
• https://kb.cert.org/vuls/id/168699 · Note