Unscored CVE-2016-3972 EUVD-2016-4981GHSA-2237-fvgv-wpg8

Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitr…

Published Apr 18, 2016 · Updated Aug 6, 2024 · Assigned by mitre

Description

Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the fileName parameter.

References

http://dotcms.com/security/SI-34
20160408 [CVE-2016-3972]DotCMS Directory traversal vulnerability mailing-list