CVE-2023-3042

CVSS 3.1 Score 8.8 of 10 (high)

Details

Published Oct 17, 2023
Updated: Oct 25, 2023
CWE ID 863

Summary

CVE-2023-3042 is a vulnerability affecting dotCMS where the NormalizationFilter fails to remove double slashes (//) from URLs. This oversight can lead to XSS and access control bypasses. For instance, the URL <https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.jsp> should return a 404 response but didn't. The root cause is an issue in the default invalid URL character list (<https://github.com/dotCMS/core/blob/master/dotCMS/src/main/java/com/dotcms/filters/NormalizationFilter.java#L37>). To mitigate, users can block URLs containing double slashes at firewalls or configure dotCMS using the DOT_URI_NORMALIZATION_FORBIDDEN_STRINGS and DOT_URI_NORMALIZATION_FORBIDDEN_REGEX variables. The fix is available in versions 23.06+, LTS 22.03.7+, and LTS 23.01.4+.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Apache/Pulsar

Affected Vendors

  • Apache Software Foundation

Advisories, Assessments, and Mitigations

Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future

Note: This is just a basic overview providing quick insights into CVE-2023-3042 information. Gain full access to comprehensive CVE data, third party vulnerabilities, compromised credentials and more with Recorded Future
  • Gain complete coverage of your cyber, third party, and physical attack surface
  • Proactively mitigate threats before they turn into costly attacks
  • Make fast, effective, data-driven decisions

Book your demo

Sign in

Back to Vulnerability Database