CVE-2012-1826 dotCMS allows remote authenticated users to execute arbitrary Java code
MediumCVSS 6.0
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.dotcms/dotcms(Maven) | >= 1.9, < 1.9.5.1 | 1.9.5.1 |
| dotCMS | = 1.9 | No fix listed |
| dotCMS | = 1.9.2.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- github.com
- github.com product
- web.archive.org
- web.archive.org
- dotcms.com
- VU#898083 third-party-advisory us-government-resource
- 82240 vdb-entry
- 49276 third-party-advisory
- 53688 vdb-entry
- gist.github.com
- github.com