Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
CRITICAL · CVSS 9.8 CISA Known Exploited Vulnerability

CVE-2022-26352

dotCMS Unrestricted Upload of File Vulnerability

dotCMS dotCMS

An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.

CVSS
9.8
CRITICAL
EPSS
91.2%
30-day exploitation
Ransomware groups
0
recorded exploiting
Published
17 Jul 2022
NVD

Exploitation status

CISA Known Exploited Vulnerabilities

Listed by CISA on 25 August 2022. US federal agencies were required to remediate it by 15 September 2022. CISA records this vulnerability as known to be used in ransomware campaigns.

EPSS — exploitation probability

FIRST puts the probability of exploitation activity in the next 30 days at 91.2%, which is higher than 99.8% of all scored vulnerabilities. EPSS is a forecast of activity, not a measure of severity, and it is rescored daily.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Frequently asked questions

Is CVE-2022-26352 being exploited by ransomware groups?

No ransomware group in this database is currently recorded as exploiting CVE-2022-26352.

What does CVE-2022-26352 affect?

CVE-2022-26352 affects dotCMS dotCMS. An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.

How severe is CVE-2022-26352?

CVE-2022-26352 is rated CRITICAL with a CVSS base score of 9.8. EPSS puts the probability of exploitation in the next 30 days at 91.2%, higher than 99.8% of all scored vulnerabilities. It is listed in the CISA Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 15 September 2022.

How should organisations respond to CVE-2022-26352?

Apply the vendor patch for dotCMS dotCMS as the first priority, and treat any internet-facing instance as the most urgent. Because this vulnerability is associated with ransomware activity, also review whether the affected systems were reachable before patching, rather than assuming that patching alone closes the incident.