Descripción
dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution.
Acción recomendada
Aplicar las actualizaciones según las instrucciones del fabricante.
Referencias
- Aviso de dotcms.com dotcms.com/security/SI-62
- Ficha en NVD (NIST) nvd.nist.gov/vuln/detail/CVE-2022-26352