CVE-2022-45783

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in dotCMS core 4.x through 22.10.2. An authenticated directory traversal vulnerability in the dotCMS API can lead to Remote Code Execution.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.dotcms.com/security/SI-67Vendor Advisory
https://www.dotcms.com/security/SI-67Vendor Advisory

Timeline

Published: Feb 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-457868.1There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for PostgreSQL 11 & AGE fo CVE-2022-457875.5Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local CVE-2022-457889.8A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of se CVE-2022-457899.8A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the c CVE-2022-457909.1The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack CVE-2022-457927.8Project files may contain malicious contents which the software will use to create files on the filesystem. This allows directory traversal CVE-2022-457937.8Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files CVE-2022-457947.5An attacker with network access to the affected PLC (CJ-series and CS-series PLCs, all versions) may use a network protocol to read and writ CVE-2022-457967.2Command injection vulnerability in nw_interface.html in SHARP multifunction printers (MFPs)'s Digital Full-color Multifunctional System 202 CVE-2022-457977.1An arbitrary file deletion vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Servic CVE-2022-457987.8A link following vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Service could al CVE-2022-45805.4The Twenty20 Image Before-After WordPress plugin through 1.5.9 does not validate and escape some of its shortcode attributes before outputti