Description
DotCMS存在目录遍历漏洞。此漏洞是由于对外部输入的文件名缺乏校验导致的。
DotCMS processFile CVE-2022-26352 目录遍历漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nosec.org/m/share/5007.html
https://www.assetnote.io/resources/research/advisory-dotcms-remote-code-execution-cve-2022-26352
https://nvd.nist.gov/vuln/detail/CVE-2022-26352
https://medium.com/@urshilaravindran/cve-2022-26352-decoding-the-high-impact-rce-vulnerability-in-dotcms-d52535781e78
https://safe.security/resources/blog/dotcms-remote-code-execution/
https://www.cve.org/CVERecord?id=CVE-2022-26352
https://github.com/rapid7/metasploit-framework/issues/16522
https://www.acunetix.com/vulnerabilities/web/dotcms-unrestricted-file-upload-cve-2022-26352/
https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33714
https://thehackernews.com/2022/05/critical-rce-bug-reported-in-dotcms.html
https://pentest-tools.com/vulnerabilities-exploits/dotcms-remote-code-execution_87
https://www.sentinelone.com/vulnerability-database/cve-2022-26352/
https://sara-open.sirp.io/kev/CVE-2022-26352