CVE-2020-6754

Katalog CVE

CVSS 9.8 · Critical EPSS 94,8%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada dotcms. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It allows an attacker to read or execute files under $TOMCAT_HOME/webapps/ROOT/assets (which should be a protected directory). Additionally, attackers can upload temporary files (e.g., .jsp files) into /webapps/ROOT/assets/tmp_upload, which can lead to remote command execution (with the permissions of the user running the dotCMS application).

Rincian

Terbit di NVD

5 Februari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

94,8% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://dotcms.com/security/SI-54 exploit · mitigasi · advisory vendor
• https://github.com/dotCMS/core/issues/17796 exploit · advisory pihak ketiga