Detections
Analytics
dotCMS Multiple Script id Parameter Traversal Local File Inclusion
medium Nessus Plugin ID 33925
Language:
Synopsis
The remote web server contains a Java application that is affected by multiple directory traversal vulnerabilities.Description
The remote host is using dotCMS, an open source J2EE / Java web content management system.The version of dotCMS installed on the remote host fails to sanitize input to the 'id' parameter of the 'news/index.dot' and 'getting_started/macros/macros_detail.dot' scripts before using it to access files. An unauthenticated attacker may be able to leverage this issue to retrieve the contents of arbitrary files on the remote host, subject to the privileges of the web server user id.
Solution
Update to the fixed version of 'DotResourceLoader.java' as discussed in the references above.See Also
http://www.nessus.org/u?1478b8e6
https://groups.yahoo.com/neo/groups/dotcms/conversations/topics/2467
Plugin Details
Severity: Medium
ID: 33925
File Name: dotcms_id_traversal.nasl
Version: 1.20
Type: remote
Family: CGI abuses
Published: 8/18/2008
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 4.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
Vulnerability Information
CPE: cpe:/a:dotcms:dotcms
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: Exploits are available
Exploited by Nessus: true
Reference Information
CVE: CVE-2008-3708
BID: 30703