Description
A Reflected Cross-site scripting (XSS) issue was discovered in dotCMS Core through 22.06. This occurs in the admin portal when the configuration has XSS_PROTECTION_ENABLED=false. NOTE: the vendor disputes this because the current product behavior, in effect, has XSS_PROTECTION_ENABLED=true in all configurations
Remediation
References
Related Vulnerabilities
Python Cryptographic Issues Vulnerability (CVE-2012-1150)
Apache HTTP Server Other Vulnerability (CVE-2002-2029)
Drupal Core 4.6.x Cross-Site Scripting (4.6.0 - 4.6.3)
Oracle JRE CVE-2013-1475 Vulnerability (CVE-2013-1475)
Jboss EAP Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2017-7465)