Directory Traversal Vulnerability in dotCMS by dotCMS

CVE-2020-6754

What is CVE-2020-6754?

A vulnerability in dotCMS before version 5.2.4 allows directory traversal, potentially permitting unauthorized access to system files within the $TOMCAT_HOME/webapps/ROOT/assets directory, which should be secured. An attacker could exploit this flaw to read sensitive files or execute code due to improper access controls. The vulnerability also facilitates the uploading of temporary files, such as .jsp files, into the /webapps/ROOT/assets/tmp_upload directory, creating a risk for remote command execution with the permissions of the user running the dotCMS application.

References