CVE-2017-3187

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2017-3187

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-3187.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2017-3187

Published

2018-07-24T15:29:00.547Z

Modified

2026-03-14T14:28:13.916813Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

The dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgery. The dotCMS administrator panel contains a cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with the same permissions as a victim user, provided the victim has an active session and is induced to trigger the malicious request. An unauthenticated remote attacker may perform actions with the dotCMS administrator panel with the same permissions of a victim user or execute arbitrary system commands with the permissions of the user running the dotCMS application.

References

Affected packages

Git / github.com/dotcms/core

Affected ranges

Type

GIT

Repo

https://github.com/dotcms/core

Events

Introduced

Last affected

8d1e90ad869f3e4bba6dbd8a91f6cb8f5326d965

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.7.1"
        }
    ]
}

Affected versions

3.*

3.0

3.2

3.2.1

3.5

3.5_Preview01

3.5_Preview02

3.6.0

3.6.1

3.7.1

pre3.*

pre3.5buildrevert

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-3187.json"