Description

SQL injection vulnerability in the "Site Browser > Links pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.

Remediation

References

CVE-2016-8906

Related Vulnerabilities

WordPress Plugin Wow Moodboard Lite Open Redirect (1.1.1.1)

WordPress Plugin Visualizer:Tables and Charts Manager for WordPress SQL Injection (3.11.1)

WordPress Plugin Easy Digital Downloads-htaccess Editor Cross-Site Scripting (1.0.0)

IBM WebSEAL CVE-2018-1813 Vulnerability (CVE-2018-1813)

WordPress Plugin Abandoned Cart Lite for WooCommerce Cross-Site Scripting (5.1.3)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-138 CVE-2016-8906