PT-2018-7245 · Dotcms · Dotcms

Darong Tong + 2 · Published 2018-07-24 · Updated 2019-10-09 · CVE-2017-3189

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: dotCMS versions 3.7.1 and earlier

Description: The issue concerns the "Push Publishing" feature in Enterprise Pro, which is vulnerable to arbitrary file upload. When "Bundle" tar.gz archives are uploaded and decompressed, there are no checks on the file types within the bundle. This can be combined with a path traversal issue to lead to remote command execution with the permissions of the user running the dotCMS application. An unauthenticated remote attacker may perform actions with the dotCMS administrator panel or execute arbitrary system commands with the permissions of the user running the dotCMS application.

Recommendations: For dotCMS versions 3.7.1 and earlier, consider disabling the "Push Publishing" feature until a patch is available to prevent arbitrary file uploads. Restrict access to the dotCMS administration panel to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2017-3189

Affected Products

Dotcms

References · 5

• https://osv.dev/vulnerability/CVE-2017-3189 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3189 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3189 · Note
• http://securityfocus.com/bid/96616 · Note
• https://kb.cert.org/vuls/id/168699 · Note