CVE-2022-45782

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A cryptographically insecure random generation algorithm for password-reset token generation leads to account takeover.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-338

Affected software

No affected versions have been published.

Timeline

Published: Feb 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-457836.5An issue was discovered in dotCMS core 4.x through 22.10.2. An authenticated directory traversal vulnerability in the dotCMS API can lead to CVE-2022-457868.1There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for PostgreSQL 11 & AGE fo CVE-2022-457875.5Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local CVE-2022-457889.8A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of se CVE-2022-457899.8A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the c CVE-2022-457909.1The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack CVE-2022-457927.8Project files may contain malicious contents which the software will use to create files on the filesystem. This allows directory traversal CVE-2022-457937.8Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files CVE-2022-457947.5An attacker with network access to the affected PLC (CJ-series and CS-series PLCs, all versions) may use a network protocol to read and writ CVE-2022-457967.2Command injection vulnerability in nw_interface.html in SHARP multifunction printers (MFPs)'s Digital Full-color Multifunctional System 202 CVE-2022-457977.1An arbitrary file deletion vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Servic CVE-2022-457987.8A link following vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Service could al