PT-2020-19212 · Dotcms · Dotcms

Published 2020-02-05 · Updated 2020-02-07 · CVE-2020-6754

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dotCMS versions prior to 5.2.4

Description The issue allows for directory traversal, leading to incorrect access control. This enables an attacker to read or execute files under $TOMCAT HOME/webapps/ROOT/assets, a directory that should be protected. Furthermore, attackers can upload temporary files, such as .jsp files, into /webapps/ROOT/assets/tmp upload, potentially leading to remote command execution with the permissions of the user running the dotCMS application.

Recommendations For versions prior to 5.2.4, update to version 5.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the /webapps/ROOT/assets directory and disabling the ability to upload files to /webapps/ROOT/assets/tmp upload until the update is applied.

Exploit

Fix

Unrestricted File Upload

Path traversal

Weakness Enumeration

CWE-434

CWE-22

Related Identifiers

CVE-2020-6754

Affected Products

Dotcms

References · 5

• 🔥 https://github.com/dotCMS/core/issues/17796 · Exploit
• 🔥 https://dotcms.com/security/SI-54 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-6754 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6754 · Vendor Advisory
• https://t.me/cvenotify/794 · Telegram Post