Approved changes feed: RSS · Atom
cpe:2.3:a:dotcms:dotcms:*:*:*:*:-:*:*:*
part: a version: * update: *
| Vendor | Dotcms (f87a28fd-603b-5a54-bf85-9747cd18195f) |
|---|---|
| Product | Dotcms (93150035-5aef-51ee-a96c-c57b0367f6d2) |
| Edition | * |
| Language | * |
| Software edition | - |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/dotcms/core |
purl2cpe | 2026-06-01 10:16:07.208642 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-37034 |
vulnerable | 2026-06-08 05:46:08.537268 |
Details available
In dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting the dotCMS server to download a large file. If done repeatedly, this will result in Tomcat request-thread exhaustion and ultimately a denial of any other requests.
Published: 2023-02-01T00:00:00.000Z
Updated: 2025-03-27T16:14:45.446Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-37033 |
vulnerable | 2026-06-08 05:46:08.536804 |
Details available
In dotCMS 5.x-22.06, TempFileAPI allows a user to create a temporary file based on a passed in URL, while attempting to block any SSRF access to local IP addresses or private subnets. In resolving this URL, the TempFileAPI follows any 302 redirects that the remote URL returns. Because there is no re-validation of the redirect URL, the TempFileAPI can be used to return data from those local/private hosts that should not be accessible remotely.
Published: 2023-02-01T00:00:00.000Z
Updated: 2025-03-27T16:21:33.289Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.