Darong Tong

Name of the Vulnerable Software and Affected Versions: dotCMS versions 3.7.1 and earlier Description: The dotCMS administration panel contains a cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with the same permissions as a victim user, provided the victim has an active session and is induced to trigger the malicious request. An unauthenticated remote attacker may perform actions with the dotCMS administrator panel with the same permissions of a victim user or execute arbitrary system commands with the permissions of the user running the dotCMS application. Recommendations: For dotCMS versions 3.7.1 and earlier, update to a version later than 3.7.1 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: dotCMS versions 3.7.1 and earlier Description: The issue concerns the "Push Publishing" feature in Enterprise Pro, where the dotCMS administration panel is vulnerable to path traversal. This occurs when "Bundle" tar.gz archives are uploaded and decompressed, allowing files to be written to arbitrary directories due to improper filename checking. An unauthenticated remote attacker can exploit this to perform actions with the same permissions as a victim user or execute arbitrary system commands with the permissions of the user running the dotCMS application. Recommendations: For dotCMS versions 3.7.1 and earlier, as a temporary workaround, consider disabling the "Push Publishing" feature until a patch is available. Restrict access to the administration panel to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: dotCMS versions 3.7.1 and earlier Description: The issue concerns the "Push Publishing" feature in Enterprise Pro, which is vulnerable to arbitrary file upload. When "Bundle" tar.gz archives are uploaded and decompressed, there are no checks on the file types within the bundle. This can be combined with a path traversal issue to lead to remote command execution with the permissions of the user running the dotCMS application. An unauthenticated remote attacker may perform actions with the dotCMS administrator panel or execute arbitrary system commands with the permissions of the user running the dotCMS application. Recommendations: For dotCMS versions 3.7.1 and earlier, consider disabling the "Push Publishing" feature until a patch is available to prevent arbitrary file uploads. Restrict access to the dotCMS administration panel to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.