漏洞描述
DotCMS management system contains an arbitrary file upload vulnerability via the /api/content/ path which can allow attackers to upload malicious Trojans to obtain server permissions.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
blog.assetnote.iohttps://blog.assetnote.io/2022/05/03/hacking-a-bank-using-dotcms-rce/↗cve.mitre.orghttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26352↗packetstormsecurity.comhttp://packetstormsecurity.com/files/167365/dotCMS-Shell-Upload.html↗groups.google.comhttps://groups.google.com/g/dotcms↗