CVE-2020-27848

HIGH

dotcms < 20.10.1 - Authenticated SQL Injection via orderby Parameter

Title source: llm
STIX 2.1

Description

dotCMS before 20.10.1 allows SQL injection, as demonstrated by the /api/v1/containers orderby parameter. The PaginatorOrdered classes that are used to paginate results of a REST endpoints do not sanitize the orderBy parameter and in some cases it is vulnerable to SQL injection attacks. A user must be an authenticated manager in the dotCMS system to exploit this vulnerability.

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/dotCMS/core/issues/19500
Patch, Third Party Advisory x_refsource_confirm
https://github.com/dotCMS/core/compare/v5.3.8.1...v20.10.1

Scores

CVSS v3 8.8
EPSS 0.0122
EPSS Percentile 65.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
dotcms/dotcms < 20.10.1
Published Dec 30, 2020
Tracked Since Feb 18, 2026