CVE-2020-18875

2021-08-1816:55:53

mitre

www.cve.org

access control

dotcms

privilege escalation

vtl files

AI Score

8.9

Confidence

High

EPSS

0.004

Percentile

74.9%

JSON

Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges by injecting client configurations via vtl (velocity) files.

References

cwe.mitre.org/data/definitions/284.html

dotcms.com/security/SI-51

github.com/dotCMS/core/issues/15882