CVE-2017-3188

{"id": "CVE-2017-3188", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2018-07-24T15:29:00.593", "references": [{"url": "http://www.securityfocus.com/bid/96616", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cret@cert.org"}, {"url": "https://doc.dotcms.com/security/SI-41", "tags": ["Vendor Advisory"], "source": "nvd@nist.gov"}, {"url": "https://www.kb.cert.org/vuls/id/168699", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cret@cert.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Secondary", "source": "cret@cert.org", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "The dotCMS administration panel, versions 3.7.1 and earlier, \"Push Publishing\" feature in Enterprise Pro is vulnerable to path traversal. When \"Bundle\" tar.gz archives uploaded to the Push Publishing feature are decompressed, the filenames of its contents are not properly checked, allowing for writing files to arbitrary directories on the file system. These archives may be uploaded directly via the administrator panel, or using the CSRF vulnerability (CVE-2017-3187). An unauthenticated remote attacker may perform actions with the dotCMS administrator panel with the same permissions of a victim user or execute arbitrary system commands with the permissions of the user running the dotCMS application."}, {"lang": "es", "value": "En el panel de administrador de dotCMS, en versiones 3.7.1 y anteriores, la caracter\u00edstica \"Push Publishing\" en Enterprise Pro es vulnerable a un salto de directorio. Cuando los archivos \"Bundle\" tar.gz se suben a la funcionalidad Push Publishing se descomprimen, los nombres de archivo de sus contenidos no se comprueban correctamente, lo que permite escribir archivos en directorios arbitrarios del sistema de archivos. Estos archivos podr\u00edan subirse directamente mediante el panel de administraci\u00f3n o mediante la vulnerabilidad CSRF (CVE-2017-3187). Un atacante remoto no autenticado podr\u00eda realizar acciones con el panel de administrador de dotCMS con los mismos permisos que un usuario v\u00edctima o ejecutar comandos arbitrarios del sistema con los permisos del usuario que ejecuta la aplicaci\u00f3n dotCMS."}], "lastModified": "2019-10-09T23:27:20.680", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dotcms:dotcms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B9E0DEC1-1F66-46E4-B9C7-9E403541CADC", "versionEndIncluding": "3.7.1"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}