Actively exploited · Published Jul 17, 2022 · Assigned by mitre

CVE-2022-26352

Critical 9.8 Exploited Ransomware

In plain English

A critical-severity security flaw in dotCMS from dotCMS. Attackers are actively exploiting it in the wild (listed by CISA on August 25, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 91.2% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)91.2%top 0.2% of all CVEs

Exploited in the wildYesCISA KEV since Aug 25, 2022

Attack tooling2Metasploit, Nuclei

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Sep 15, 2022.

Official description

An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://groups.google.com/g/dotcms x_refsource_MISC
http://packetstormsecurity.com/files/167365/dotCMS-Shell-Upload.html x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26352 government-resource