dotCMS up to 5.2.3 Access Control assets unrestricted upload

Summaryinfo

A vulnerability was found in dotCMS up to 5.2.3. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the file $TOMCAT_HOME/webapps/ROOT/assets of the component Access Control. Performing a manipulation results in unrestricted upload. This vulnerability is identified as CVE-2020-6754. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in dotCMS up to 5.2.3 (Content Management System). It has been classified as critical. This affects an unknown code block of the file $TOMCAT_HOME/webapps/ROOT/assets of the component Access Control. The manipulation with an unknown input leads to a unrestricted upload vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It allows an attacker to read or execute files under $TOMCAT_HOME/webapps/ROOT/assets (which should be a protected directory). Additionally, attackers can upload temporary files (e.g., .jsp files) into /webapps/ROOT/assets/tmp_upload, which can lead to remote command execution (with the permissions of the user running the dotCMS application).

The weakness was released 02/05/2020 (Website). The advisory is shared at dotcms.com. This vulnerability is uniquely identified as CVE-2020-6754 since 01/09/2020. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1608.002 for this issue.

Upgrading to version 5.2.4 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Content Management System

Name

• dotCMS

Version

• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion