GitHub Advisoryadvisory · Maven
GHSA-42vg-q6mw-cfh5 dotCMS allows remote authenticated users to execute arbitrary Java code
HIGH
Official page ↗
- Aliases
- CVE-2012-1826
- Ecosystem
- Maven
- Packages
- com.dotcms:dotcms
- Severity
- High
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Reviewed
- 2025-04-12
Affected packages
• Maven com.dotcms:dotcms: >= 1.9, < 1.9.5.1 → fixed in 1.9.5.1
Description
dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template.
Related
Alias · CVE (1)
- CVE-2012-1826 dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template. vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2012-1826 advisory
- https://github.com/dotCMS/dotCMS/issues/261 web
- https://github.com/dotCMS/dotCMS/issues/281 web
- https://github.com/dotCMS/dotCMS package
- https://web.archive.org/web/20201208044614/https://gist.github.com/jtesser/2627440 web
- https://web.archive.org/web/20210124000108/https://www.securityfocus.com/bid/53688 web
- http://dotcms.com/dotCMSVersions web
- http://www.kb.cert.org/vuls/id/898083 web