2022-05-17 07:45:41 +00:00
id : CVE-2018-17422
info :
2022-12-16 02:10:24 +00:00
name : DotCMS < 5.0.2 - Open Redirect
2022-05-17 07:45:41 +00:00
author : 0x_Akoko,daffainfo
severity : medium
2022-05-17 07:54:44 +00:00
description : |
2022-10-19 21:11:27 +00:00
dotCMS before 5.0.2 contains multiple open redirect vulnerabilities via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext/common/page_preview_popup.jsp hostname parameter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
2023-09-06 12:57:14 +00:00
remediation : |
Upgrade to a version of DotCMS that is higher than 5.0.2 to mitigate the open redirect vulnerability.
2022-05-17 07:45:41 +00:00
reference :
- https://github.com/dotCMS/core/issues/15286
2022-10-19 21:11:27 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2018-17422
2022-05-17 07:45:41 +00:00
classification :
2022-05-17 20:46:49 +00:00
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2022-05-17 07:45:41 +00:00
cvss-score : 6.1
cve-id : CVE-2018-17422
cwe-id : CWE-601
2023-07-11 19:49:27 +00:00
epss-score : 0.00118
2023-10-19 10:38:59 +00:00
epss-percentile : 0.45536
2023-09-06 12:57:14 +00:00
cpe : cpe:2.3:a:dotcms:dotcms:*:*:*:*:*:*:*:*
2022-05-17 07:45:41 +00:00
metadata :
2022-12-16 02:10:24 +00:00
verified : true
2023-09-06 12:57:14 +00:00
max-request : 2
2023-07-11 19:49:27 +00:00
vendor : dotcms
product : dotcms
2023-09-06 12:57:14 +00:00
shodan-query : http.title:"dotCMS"
2022-05-17 07:45:41 +00:00
tags : cve,cve2018,redirect,dotcms
2023-04-27 04:28:59 +00:00
http :
2022-05-17 07:45:41 +00:00
- method : GET
path :
2022-12-14 06:27:06 +00:00
- '{{BaseURL}}/html/common/forward_js.jsp?FORWARD_URL=http://evil.com'
- '{{BaseURL}}/html/portlet/ext/common/page_preview_popup.jsp?hostname=evil.com'
2022-05-17 07:45:41 +00:00
stop-at-first-match : true
matchers :
- type : word
part : body
words :
2022-12-14 06:27:06 +00:00
- "self.location = 'http://evil.com'"
- "location.href = 'http\\x3a\\x2f\\x2fwww\\x2eevil\\x2ecom'"