PT-2023-14751 · Dotcms · Dotcms

Published 2023-02-01 · Updated 2025-03-27 · CVE-2022-45782

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dotCMS core versions 5.3.8.5 through 5.3.8.15 dotCMS core versions 21.03 through 22.10.1

Description An issue was discovered in dotCMS core where a cryptographically insecure random generation algorithm is used for password-reset token generation, leading to account takeover.

Recommendations For versions 5.3.8.5 through 5.3.8.15, update to a version outside of this range to resolve the issue. For versions 21.03 through 22.10.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider disabling the password-reset feature until a patch is available. Restrict access to the password-reset functionality to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2022-45782

Affected Products

Dotcms

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-45782 · Security Note
• https://dotcms.com/security/SI-66 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45782 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45782 · Note
• https://t.me/cvenotify/116551 · Telegram Post
• https://t.me/cvenotify/43389 · Telegram Post
• https://t.me/cibsecurity/57362 · Telegram Post