Skip to content
OpenAdvisories

Vendor

dotCMS

9 known vulnerabilities.

Products

dotCMS Core 6 dotCMS 2 dotCMS Cloud Services (dCS) 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.4
    CVE-2024-3938

    The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patc…

    dotCMS dotCMS Core
  • Medium 4.5
    CVE-2024-3165

    Database Credential Exposure in the Logs

    System->Maintenance-> Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment.   OWAS…

    dotCMS dotCMS Core
  • Medium 4.5
    CVE-2024-3164

    In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an A…

    dotCMS dotCMS Core
  • Medium 5.3
    CVE-2023-3042

    CNA SHORTNAME: dotCMSORG UUID: 5b9d93f2-25c7-46b4-ab60-d201718c9dd8

    In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes (//) from URLs, potentially enabling bypasses for XSS and access controls. An example affected URL is https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.…

    dotCMS dotCMS Core