CVE-2020-27848

    Dashboard / Vulnerabilities / CVE-2020-27848

    CVE-2020-27848

    Published: 30 Dec 2020Last Modified: 7 Aug 2026

    Summary:

    Details: dotCMS before 20.10.1 allows SQL injection, as demonstrated by the /api/v1/containers orderby parameter. The PaginatorOrdered classes that are used to paginate results of a REST endpoints do not sanitize the orderBy parameter and in some cases it is vulnerable to SQL injection attacks. A user must be an authenticated manager in the dotCMS system to exploit this vulnerability.

    References: https://github.com/dotCMS/core/compare/v5.3.8.1...v20.10.1, https://github.com/dotCMS/core/issues/19500

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -d4ddc0720ee33a4be18823bb8b8cfad3f435240c

    Affected versions

    3.6.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2020-27848 | CVE-DB