CVE-2017-3187 The dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgery
An attacker can trick an authenticated administrator into executing arbitrary system commands or actions via cross-site request forgery in the dotCMS administration panel.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2017-3187?
CVE-2017-3187 is a high-severity vulnerability in Dotcms Dotcms, published on 24 Jul 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgery. The dotCMS administrator panel contains a cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with the same permissions as a victim user, provided the victim has an active session and is induced to trigger the malicious request. An unauthenticated remote attacker may perform actions with the dotCMS administrator panel with the same permissions of a victim user or execute arbitrary system commands with the permissions of the user running the dotCMS application.
Weakness: CWE-352
Which versions are affected by CVE-2017-3187?
It affects 1 product.
Products include Dotcms Dotcms.
How do I fix CVE-2017-3187?
No fix has been published for CVE-2017-3187 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-3187 being exploited?
There is no known exploitation of CVE-2017-3187 in the wild and no public exploit code.
Other vulnerabilities in Dotcms Dotcms
Sources
Also known as GHSA-wcqw-wpq6-v3g4.