CVE-2012-1826 : dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary

dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template.

Published 2012-06-08 16:55:01

Updated 2012-11-27 04:41:23

Source CERT/CC

View at NVD, CVE.org

Products affected by CVE-2012-1826

Dotcms » Dotcms » Version: 1.9.2.1
cpe:2.3:a:dotcms:dotcms:1.9.2.1:*:*:*:*:*:*:*
Matching versions
Dotcms » Dotcms » Version: 1.9
cpe:2.3:a:dotcms:dotcms:1.9:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.49%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 73 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.0	MEDIUM	AV:N/AC:M/Au:S/C:P/I:P/A:P	6.8	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

http://dotcms.com/dotCMSVersions/

404 | dotCMS
https://github.com/dotCMS/dotCMS/issues/261

Fix XSLT Scripting Exploit · Issue #261 · dotCMS/core · GitHub
https://gist.github.com/2627440

XSLT Tool Patch · GitHub
http://www.securityfocus.com/bid/53688

dotCMS CVE-2012-1826 Arbitrary Code Execution Vulnerability
http://www.kb.cert.org/vuls/id/898083

VU#898083 - dotCMS template permissions allow arbitrary code execution
US Government Resource
https://github.com/dotCMS/dotCMS/issues/281

Make the default uberspector of of Velocity use the Secure One · Issue #281 · dotCMS/core · GitHub

Jump to