Reflected XSS Vulnerability in dotCMS Core Admin Portal
CVE-2022-37431

6.1MEDIUM

Key Information:

Vendor

Dotcms

Status
Dotcms
Vendor
CVE Published:
5 August 2022

What is CVE-2022-37431?

A reflected cross-site scripting (XSS) vulnerability has been identified in the dotCMS Core Admin Portal for versions up to 22.06. This vulnerability arises when XSS protection is disabled (XSS_PROTECTION_ENABLED=false), potentially allowing attackers to inject malicious scripts. Although the vendor claims that XSS protection is effectively enabled in all configurations, this assertion is disputed and requires careful consideration for users managing sensitive data in the application.

References

https://fortiguard.fortinet.com/zeroday/FG-VD-22-062
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.