Dotcms Cloud Services (Dcs)
Approved changes feed: RSS · Atom
cpe:2.3:a:dotcms:dotcms_cloud_services_(dcs):*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Dotcms (f87a28fd-603b-5a54-bf85-9747cd18195f) |
|---|---|
| Product | Dotcms Cloud Services (Dcs) (d3440a59-40ed-55aa-9b36-fdce0c1d6b0a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-8311 |
vulnerable | 2026-06-08 07:45:19.973397 |
Details available
dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpoint. This endpoint uses the sites query parameter, which accepts a comma-separated list of site identifiers or keys.
The vulnerability was triggered via the sites parameter, which was directly concatenated into a SQL query without proper sanitization.
Exploitation allowed an authenticated attacker with low privileges to extract data from database, perform privilege escalation, or trigger denial-of-service conditions.
The vulnerability was verified using tools such as SQLMap and confirmed to allow full database exfiltration and potential denial-of-service conditions via crafted payloads.
The vulnerability is fixed in the following versions of dotCMS stack: 25.08.14 / 25.07.10-1v2 LTS / 24.12.27v10 LTS / 24.04.24v21 LTS
Published: 2025-09-04T14:12:42.176Z
Updated: 2025-09-11T14:43:50.767Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.