SQL Injection Vulnerability in dotCMS by dotCMS
CVE-2016-10008

7.2HIGH

Key Information:

Vendor

Dotcms

Status
Dotcms
Vendor
CVE Published:
19 February 2018

What is CVE-2016-10008?

A SQL injection vulnerability exists in the 'Content Types > Content Types' screen of dotCMS prior to version 3.7.2 and 4.x before 4.1.1. This flaw permits remotely authenticated administrators to execute arbitrary SQL commands through the manipulation of the _EXT_STRUCTURE_direction parameter. Such exploitation can lead to unauthorized access to the database, potentially allowing attackers to retrieve sensitive data or manipulate the database structure.

References

https://security.elarlang.eu/cve-2016-10007-and-cve-2016-...
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.