{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-3042", "assignerOrgId": "5b9d93f2-25c7-46b4-ab60-d201718c9dd8", "state": "PUBLISHED", "assignerShortName": "dotCMS", "dateReserved": "2023-06-01T20:26:04.134Z", "datePublished": "2023-10-17T22:52:05.453Z", "dateUpdated": "2023-10-23T16:58:08.007Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "dotCMS core", "vendor": "dotCMS", "versions": [{"status": "affected", "version": "5.3.8"}, {"status": "affected", "version": "21.06"}, {"status": "affected", "version": "22.03"}, {"status": "affected", "version": "23.01"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes (//) from URLs, potentially enabling bypasses for XSS and access controls. An example affected URL is <a target=\"_blank\" rel=\"nofollow\" href=\"https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.jsp\">https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.jsp</a>, which should return a 404 response but didn't. <br><br>The oversight in the default invalid URL character list can be viewed at the provided <a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/dotCMS/core/blob/master/dotCMS/src/main/java/com/dotcms/filters/NormalizationFilter.java#L37\">GitHub link</a>.&nbsp;<br><br>To mitigate, users can block URLs with double slashes at firewalls or utilize dotCMS config variables.<br><br>Specifically, they can use the DOT_URI_NORMALIZATION_FORBIDDEN_STRINGS environmental variable to add // to the list of invalid strings. <br><br>Additionally, the DOT_URI_NORMALIZATION_FORBIDDEN_REGEX variable offers more detailed control, for instance, to block //html.* URLs.<br><br><table><tbody><tr><th>Fix Version:</th><td>23.06+, LTS 22.03.7+, LTS 23.01.4+</td></tr></tbody></table><br>"}], "value": "In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes (//) from URLs, potentially enabling bypasses for XSS and access controls. An example affected URL is https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.jsp https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.jsp , which should return a 404 response but didn't. \n\nThe oversight in the default invalid URL character list can be viewed at the provided GitHub link https://github.com/dotCMS/core/blob/master/dotCMS/src/main/java/com/dotcms/filters/NormalizationFilter.java#L37 .\u00a0\n\nTo mitigate, users can block URLs with double slashes at firewalls or utilize dotCMS config variables.\n\nSpecifically, they can use the DOT_URI_NORMALIZATION_FORBIDDEN_STRINGS environmental variable to add // to the list of invalid strings. \n\nAdditionally, the DOT_URI_NORMALIZATION_FORBIDDEN_REGEX variable offers more detailed control, for instance, to block //html.* URLs.\n\nFix Version:23.06+, LTS 22.03.7+, LTS 23.01.4+\n"}], "impacts": [{"capecId": "CAPEC-247", "descriptions": [{"lang": "en", "value": "CAPEC-247 XSS Using Invalid Characters"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5b9d93f2-25c7-46b4-ab60-d201718c9dd8", "shortName": "dotCMS", "dateUpdated": "2023-10-23T16:58:08.007Z"}, "references": [{"url": "https://www.dotcms.com/security/SI-68"}], "source": {"discovery": "UNKNOWN"}, "title": "CNA SHORTNAME: dotCMSORG UUID: 5b9d93f2-25c7-46b4-ab60-d201718c9dd8", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dotcms:dotcms:5.3.8:*:*:*:*:*:*:*", "matchCriteriaId": "1B26B5D7-CE8E-4908-8D46-A78B1A4245BA", "vulnerable": true}, {"criteria": "cpe:2.3:a:dotcms:dotcms:21.06:*:*:*:*:*:*:*", "matchCriteriaId": "98D4378C-DEAC-44C1-89D1-A4846450E153", "vulnerable": true}, {"criteria": "cpe:2.3:a:dotcms:dotcms:22.03:*:*:*:*:*:*:*", "matchCriteriaId": "5FC8E88E-4C9A-4FE9-A3B6-2A5707323F1E", "vulnerable": true}, {"criteria": "cpe:2.3:a:dotcms:dotcms:23.01:*:*:*:*:*:*:*", "matchCriteriaId": "D68AC1E5-1756-4838-8BE5-78B2F1435A6C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes (//) from URLs, potentially enabling bypasses for XSS and access controls. An example affected URL is https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.jsp https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.jsp , which should return a 404 response but didn't. \n\nThe oversight in the default invalid URL character list can be viewed at the provided GitHub link https://github.com/dotCMS/core/blob/master/dotCMS/src/main/java/com/dotcms/filters/NormalizationFilter.java#L37 .\u00a0\n\nTo mitigate, users can block URLs with double slashes at firewalls or utilize dotCMS config variables.\n\nSpecifically, they can use the DOT_URI_NORMALIZATION_FORBIDDEN_STRINGS environmental variable to add // to the list of invalid strings. \n\nAdditionally, the DOT_URI_NORMALIZATION_FORBIDDEN_REGEX variable offers more detailed control, for instance, to block //html.* URLs.\n\nFix Version:23.06+, LTS 22.03.7+, LTS 23.01.4+\n"}, {"lang": "es", "value": "En dotCMS, versiones mencionadas, una falla en NormalizationFilter no elimina las barras dobles (//) de las URL, lo que potencialmente permite omitir XSS y controles de acceso. Un ejemplo de URL afectada es https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.jsp https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.jsp, que deber\u00eda devolver una respuesta 404 pero no lo hizo. La supervisi\u00f3n de la lista predeterminada de caracteres de URL no v\u00e1lidos se puede ver en el enlace proporcionado de GitHub https://github.com/dotCMS/core/blob/master/dotCMS/src/main/java/com/dotcms/filters/NormalizationFilter.java #L37. Para mitigar, los usuarios pueden bloquear las URL con barras dobles en los firewalls o utilizar variables de configuraci\u00f3n de dotCMS. Espec\u00edficamente, pueden usar la variable ambiental DOT_URI_NORMALIZATION_FORBIDDEN_STRINGS para agregar // a la lista de cadenas no v\u00e1lidas. Adem\u00e1s, la variable DOT_URI_NORMALIZATION_FORBIDDEN_REGEX ofrece un control m\u00e1s detallado, por ejemplo, para bloquear URL //html.*. Versi\u00f3n reparada: 23.06+, LTS 22.03.7+, LTS 23.01.4+"}], "id": "CVE-2023-3042", "lastModified": "2023-10-25T14:31:29.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@dotcms.com", "type": "Secondary"}]}, "published": "2023-10-17T23:15:11.920", "references": [{"source": "security@dotcms.com", "tags": ["Vendor Advisory"], "url": "https://www.dotcms.com/security/SI-68"}], "sourceIdentifier": "security@dotcms.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "security@dotcms.com", "type": "Secondary"}]}

{}