Arbitrary File Upload Vulnerability in dotCMS by dotCMS
CVE-2017-11466

7.2HIGH

Key Information:

Vendor: Dotcms
Status: Dotcms
Vendor: CVE Published:; 20 July 2017

What is CVE-2017-11466?

An arbitrary file upload vulnerability exists in dotCMS version 4.1.1, specifically within the AjaxFileUploadServlet class. This vulnerability allows remote authenticated administrators to exploit directory traversal sequences in the fieldName parameter when uploading files, potentially enabling the upload of malicious .jsp files to unauthorized locations. Upon successful uploading, these files can be executed via direct access at designated URIs, posing a significant risk for arbitrary code execution and system compromise.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch